Weekly Security Roundup: Agent Controls and Patching Gaps

by TechHub

Microsoft observed an AI agent progress from finding exposed GitHub secrets to exfiltrating Azure Key Vault data in five minutes, reinforcing the need to revoke compromised credentials and investigate their access across tenants. Microsoft Execution Containers reached general availability with least-privilege boundaries for agent processes, while Dynamic Permissions and Dynamic Conditional Access scope authority to tasks and can require human approval. GitHub postponed default blocking of public-repository pull_request_target workflows to December 2, and CodeQL updates expanded language support while introducing changes that custom-query maintainers should review. Runtime guidance warns that updating Azure Pipelines agents does not necessarily patch embedded runners, cached Node.js versions, containers, or deployed applications, while Windows telemetry exposes delays in security-update deployment. The week's recurring lesson is to verify enforcement across execution paths, identities, and data access rather than assume an update, managed service, or advisory finding provides complete protection.

This Week's Overview

Runtime patching requires checks beyond the application version

The runtime advisories distinguish installing a fixed release from ensuring that every execution path uses it. Pipeline task runners, cached tool versions, containers, and deployed applications can require separate servicing.

Node.js and .NET fixes in Azure DevOps environments

Node.js fixed 10 vulnerabilities on October 21, 2026, in versions 22.23.4, 24.22.1, and 26.12.1. Azure Pipelines agent v5.281.1 includes Node24 version 24.22.1, but that runner is not present in every platform package. Updating the agent therefore needs a platform-specific check rather than an assumption that every task now uses the patched runtime.

UseNode@1 and NodeTool@0 default checkLatest to false, so broad version ranges can select older cached patches. These tasks update PATH, not the agent's embedded task runners, and containers and deployed applications need separate servicing. The guidance also identifies fixed .NET runtime baselines of 8.0.33, 9.0.22, and 10.0.14, while .NET Framework is not affected by the Brotli advisory.

PHP disclosure creates an emergency remediation window

AI-assisted security researchers demonstrated that two unconfirmed PHP bugs could lead to arbitrary remote code execution. Exploit details leaked before an official patch was deployed, and the FBI issued an urgent advisory telling organizations to patch or take affected servers offline.

Maintainers opened an emergency pull request on the official PHP Docker image, drawing more than 500 GitHub comments. For teams deploying that image, the distinction between an emergency pull request and a deployed fix matters: the report does not supply an affected-version range or a fixed release to use as a remediation baseline.

Windows discovery increases the pressure on deployment

The October 2026 Windows security update addressed more than 1,100 CVEs, or published vulnerability records. Microsoft's MDASH system uses multiple AI models and specialized agents to find and validate potential vulnerabilities, with security and engineering teams reviewing the findings. August telemetry showed that fewer than half of sampled Windows enterprise devices installed the security update within two weeks.

The operational guidance focuses on closing that deployment gap, since attackers can compare patched software with earlier versions to investigate flaws on unpatched devices. Windows Server 2025 supports hotpatching in eligible Azure, Azure Local, and Azure Arc-connected environments, while Azure Update Manager provides patch orchestration. Windows Autopatch can help manage update deployment, but hotpatch eligibility still depends on supported versions, servicing requirements, and policies.

GitHub Actions tightens execution and credential boundaries

GitHub postponed default blocking of a sensitive pull request trigger, giving affected teams more time to review workflows. Separate runner guidance shows how to isolate individual jobs and keep infrastructure credentials outside workflow execution.

Public repositories face a new pull_request_target deadline

GitHub Actions will block pull_request_target events by default in public repositories starting December 2, 2026, unless an applicable Actions event policy explicitly permits them. Permanent enforcement was previously scheduled for November 2. Brownouts are scheduled for November 9 and November 16, from 16:00-18:00 UTC, when blocked workflows will create failed runs without executing.

The change affects public repositories on GitHub Free, Team, and Enterprise Cloud, but not private or internal repositories or GitHub Enterprise Server. Because this trigger can access base-repository secrets, executing untrusted fork code can expose credentials and compromise the pipeline. Teams should review both their event policies and what code these workflows execute before treating an explicit allowance as the solution.

Ephemeral runners separate job execution from deployment identity

An Azure Container Apps design uses KEDA to start event-job executions for matching queued workflows, with minimum executions set to zero. Each repository-scoped ephemeral runner processes one workflow, deregisters, and exits. A user-assigned managed identity retrieves GitHub App credentials through a Key Vault private endpoint with public network access disabled.

Workflows use GitHub OpenID Connect (OIDC) and a separate Microsoft Entra deployment identity, with Azure role-based access control restricting deployment scope. The design avoids a dedicated Azure Container Registry by installing tools at runtime, but that increases cold-start latency and dependence on external download endpoints.

GitHub code security expands analysis and clarifies enforcement limits

GitHub's updates cover language analysis, secret detection, and repository-level security context. The accompanying engineering guidance distinguishes advisory findings from checks that can actually govern automated changes.

CodeQL updates language coverage and custom-query requirements

CodeQL 2.27.3 adds Python 3.15 syntax and builtins, JSON data extensions, and C23 bit-precise integers. Its opt-in ai threat model covers data generated by large language models, but includes no built-in source models, so users must define sources through data extensions. GitHub Actions analysis now uses the shared control-flow graph library and removes legacy Completion classes, which can require changes to custom queries.

C# analysis gains positional-pattern data flow support and passes proxy and certificate environment variables to NuGet for private registries. CodeQL 2.27.4 follows with broader Java/Kotlin sanitizer recognition and fewer false positives in Rust and C/C++, while moving JVM warnings and initialization errors to standard error to preserve machine-readable CLI output. Pack bundling and publishing now omit files whose resolved symbolic links escape the pack root and display a warning.

Both updates deploy automatically to code scanning on github.com, and their functionality will ship in GitHub Enterprise Server 3.24. Teams maintaining custom queries or automation should review the library and output changes alongside the expanded language support.

Risk assessments identify protection gaps

GitHub code security and secret risk assessments now distinguish findings in protected and unprotected repositories. Organization admins and security managers can start assessments from the Security tab in GitHub Enterprise Cloud and GitHub Team, with support for this secret risk assessment improvement coming to GitHub Enterprise Server 3.24.

Secret detection adds coverage without treating every match alike

SpaceX joined GitHub's secret scanning partnership program, adding detection for starlink_public_api_v2_secret. GitHub forwards partner secrets found in public repositories to their issuers for revocation or rotation, while detector changes for Alibaba, AWS, Google, OpenVSX, Logfire, and Tencent tighten matching and reduce unrelated results.

A GitHub Universe technical recap also highlights AI push protection for unstructured secrets in public preview. That capability requires the relevant security entitlement and enabled settings, and consumes AI credits, so its availability should not be confused with automatic coverage for every repository.

Agent-assisted changes still depend on configured verification

GitHub's agentic engineering guide organizes work into Plan, Build, Verify, and Observe, with Agent Merge able to address failing checks, review comments, and conflicts before merging when configured verification steps pass. The guide also identifies GitHub package firewall as a public preview for npm that can block downloads violating configured security policies.

The Universe recap supplies an important enforcement limit: AI Scan pull request findings are advisory and cannot currently enforce a merge requirement through a ruleset. Teams should distinguish these advisory results from the verification steps on which automated merging actually depends.

Attack investigations highlight exposed credentials and persistent access

Microsoft's threat reporting connects public credential exposure, vulnerable services, deceptive email, and bundled installers to concrete attack activity. Each investigation offers different evidence to use when scoping an incident.

Agentic tooling moves from secret discovery to cloud access

Microsoft observed an AI agent move from searching GitHub for client secrets to exfiltrating Azure Key Vault data in five minutes. Since August 2026, threat actors have used an agentic AI framework to submit large volumes of GitHub searches for secrets. As early as October 28, compromised application credentials enabled service principal sign-ins across multiple tenants, including downstream tenants of vendor-owned applications.

The observed requests showed adaptive troubleshooting: failed cloud calls were followed by changes to API versions or HTTP methods and then successful responses. Microsoft's immediate recommendation is to revoke or rotate exposed credentials, because deleting the public disclosure does not invalidate them. For application owners, the downstream-tenant activity makes the credential's authorized reach an important part of incident scoping.

ARTEX activity targets financial organizations

Cambodia-based Storm-3358 began using ARTEX in October 2026 to target financial organizations, primarily in Southeast Asia. The actor exploits anonymous file-upload and server-side request forgery (SSRF) flaws, then deploys WISP, vshell, and AdaptixC2 for persistence and lateral movement. Microsoft provides Defender XDR and Sentinel hunting queries alongside sample indicators of compromise.

Microsoft's testing found that honeypots, decoys, tarpits, and fake wins reduced attack traffic reaching real assets while generating high-confidence signals. Known threat actor infrastructure also produces high-risk Verified threat actor IP detections in Microsoft Entra ID Protection. These findings give defenders both activity to hunt and evidence for evaluating deception controls.

Email data points to overrides and changing delivery methods

Microsoft detected approximately 7.3 billion email-based phishing threats in Q3 2026, with September approaching 3 billion, up 41% from August. Of spoofed messages with a recorded security outcome in September, 63% had security overrides applied, although those figures do not establish compromise.

Delivery methods varied rather than rising uniformly: QR-code phishing fell 67% from Q2 to approximately 12.1 million attacks, while September CAPTCHA-gated phishing reached 3.1 million, nearly twice July's volume. SVG attachments accounted for 49% of the September CAPTCHA-gated attacks, giving defenders a specific attachment pattern to consider alongside override policy reviews.

Fake installers can leave multiple independent payloads

A fake-download campaign uses trojanized Inno Setup-style installers to deliver multiple monetized payloads during one installation session, including WorldProxyPool proxyware, CharityEngine and BOINC distributed computing, and AW Manager or Windows Manager utilities. Offers can succeed or fail independently, so a failed initial payload does not establish that installation stopped.

WorldProxyPool creates SYSTEM-level startup, five-minute watchdog, and hourly updater scheduled tasks. Microsoft's Defender XDR queries cover installer callbacks, staged payload execution, and outbound connections, with domain-only matches requiring further validation.

Agent authority moves into trusted execution controls

The week's agent security material places permissions, approvals, and audit outside model-generated decisions. Product controls and implementation guides apply that separation to local processes, business tools, and infrastructure operations.

Task-scoped permissions and local containment

Microsoft's November security update describes Dynamic Permissions that scope agent authority to the current task, while Dynamic Conditional Access can restrict permissions or require human approval. Microsoft Execution Containers is generally available and enforces least-privilege boundaries across files, networks, processes, and user interactions.

A companion MXC demonstration shows granular containment policies, learn modes, and flagging of agentic processes on a local machine. Together, these controls address what agent processes can actually do, rather than relying only on instructions about permitted behavior.

Tool authorization belongs outside the model

A Microsoft Foundry least-privilege guide combines identity, connection configuration, Azure role-based access control, narrow tool contracts, and runtime policy. Its invoice example binds the storage account and container server-side and derives user partitions from verified identity context, while separating read, propose, and commit capabilities. High-consequence actions require trusted approval and idempotency controls, with negative tests covering wrong tenants, unknown agents, missing user context, and disallowed actions.

The Copilot Cowork engineering account describes a similar boundary: the agent container holds no user credentials, while a trusted host controls identity, policy, approvals, tool execution, and audit. Critical changes require at least one human check in addition to agentic review. These examples make authorization an enforceable application responsibility rather than a model convention.

Infrastructure assistants separate observation from action

An Azure VM image automation guide exposes four tools through a Python Model Context Protocol (MCP) server for listing runs, inspecting status, checking release evidence, and optionally queueing an Azure DevOps pipeline. Queueing is disabled by default and, when enabled, requires explicit confirmation and allow-listed parameters. Azure DevOps approvals and permissions remain authoritative, with separate read and queue permissions recommended.

A reader-only Azure SRE Agent guide takes the observation-only approach further, using control-plane signals and collected Log Analytics data without running guest commands or changing the server. Its IIS triage skill checks telemetry availability, cites timestamped evidence, and recommends actions for operators, while narrowly scoped file auditing helps identify the account, process, and file involved in direct edits.

Fabric carries permissions across data access paths

Fabric's updates extend OneLake enforcement to additional query and storage paths while adding preview controls for connections, sharing, and security findings. The recurring boundary is that creating an object or sharing an interface does not by itself grant all the permissions needed to use its data.

Eventhouse enforces the querying user's OneLake permissions

OneLake security support for Eventhouse external tables is generally available. External tables automatically apply object-level, column-level, and row-level controls using the querying user's effective OneLake permissions. Creating an external table does not grant access to the secured data it references.

The Eventhouse endpoint can query Lakehouse data without another copy, keeping access enforcement relevant across that query path. Teams can define OneLake security roles and test table access, column restrictions, and row filters using a representative data consumer.

Databricks storage integration requires permissions on both sides

OneLake external-location support for Azure Databricks Unity Catalog is generally available from the Microsoft Fabric side. Supported Unity Catalog-managed tables, volumes, views, materialized views, and streaming tables can use underlying data in OneLake, and OneLake Security is enabled by default for Azure Databricks Storage items.

Setup requires a capacity-backed Fabric workspace, an Azure Databricks Storage item, an approved identity, a storage credential, and a Unity Catalog external location. Access must then be configured independently in Azure Databricks and Fabric, including both Unity Catalog permissions and OneLake Security permissions.

Connection policies can take existing workloads offline

Preview admin connection APIs provide tenant-wide inventory and role-assignment operations, while authentication and tenant allowlists can apply to both existing and new cloud connections. Assigning an Owner does not transfer OAuth credentials, grant source-system permissions, or guarantee that dependent workloads will run.

The tenant allowlist supports up to 100 Microsoft Entra tenant IDs, and policy changes can take up to one hour. Noncompliant existing connections can show Policy Evaluation Failure and go Offline, making enforcement a workload-impacting change rather than only a restriction on future connection creation.

IQ Share adds revocable cross-tenant access

IQ Share is in preview for sharing entire Lakehouses, Warehouses, and Mirrored Items across Fabric tenants. Data stays in the producer's tenant, and Fabric-managed shortcuts give recipients read-only access without requiring a guest identity. Producers can revoke access, set automatic expiration, and monitor shares through OneLake Catalog.

New or deleted tables automatically appear for consumers, while whole-item changes require refreshing the Share Subscription. Spark notebooks, semantic models, data agents, and ontologies currently need an intermediate Lakehouse and shortcuts rather than direct Mirrored OneLake Item access.

Database Hub turns findings into resource-specific recommendations

Database Hub is in public preview, aggregating security findings across supported database platforms and distinguishing immediate issues from longer-term suggestions. Checks vary by database type and cover authentication, data protection, auditing, and network security, with affected resources and corrective guidance shown where supported.

Broader coverage, a dedicated Security page, and agentic security analysis are future directions, not current preview capabilities. Teams evaluating the preview should assess the checks available for their database types rather than assume uniform coverage.

Foundry deployment guidance separates platform controls from application responsibility

Foundry's model and integration news comes with concrete identity and deployment requirements. The engineering guidance also identifies responsibilities that remain with application owners despite managed hosting.

Mistral availability plans include deployment and approval boundaries

Microsoft plans to make Mistral Large 4 available in public preview through Foundry in the coming days, with Mistral OCR 4 moving to general availability on the same day using OCR 4.1 weights internally. Large 4 will be available in Sweden Central for Global Standard and EU DataZone deployment. According to Mistral, the model was trained in European datacenters and has 1 trillion parameters, with 52 billion active.

The article recommends least-privilege tool access, explicit action boundaries, human approval, and observable execution for sensitive agents. Those application controls remain relevant alongside deployment-location choices, and the planned preview should not be treated as already generally available.

ComfyUI calls Foundry without stored API keys

Foundry now hosts fal video models such as MiniMax H3 Max alongside gpt-image, FLUX, and MAI Image models. Two custom ComfyUI nodes call Foundry APIs directly, allowing generation workflows to run on CPU-only machines.

The security detail is the authentication path: DefaultAzureCredential uses Azure CLI sign-in locally or managed identity on Azure, without API keys. The calling identity still needs the Cognitive Services User or Foundry User role on the Foundry resource.

A Claude Code gateway validates caller identity before backend access

CCOF is the author's implementation, not a Microsoft product, and routes Claude Code requests through Azure API Management to Foundry. The gateway validates tenant, audience, client application, and delegated scope, while managed identities authenticate backend calls. Deployment ends with authentication, model-permission, and accounting tests.

The design has operational limits: same-subscription Foundry accounts share model quota pools, and the API Management and Function Apps stack remains single-region. Displayed spend is a lower bound rather than a strict invoice cap because reconciliation is delayed and some token categories remain unknown.

Managed hosting does not take over business authorization

A multi-agent architecture guide describes managed hosting with agent identity, session sandboxes, immutable versions, private networking, and default OpenTelemetry tracing through hosting protocol libraries. Applications remain responsible for authorization, business effects, data handling, and evidence that the complete system behaves correctly. Several covered features remain in preview, have no service-level agreement, and are not recommended for production workloads.

A companion reliability checklist recommends evaluating accuracy, groundedness, task completion, tool selection, safety, and consistency before release. Restricted tool access, input validation, prompt-injection protection, human approval, timeouts, and rollback remain application-level work rather than consequences of choosing managed hosting.

Release routing and optimization need explicit controls

The operations guide warns that default routing follows the latest hosted-agent version, so teams must pin the serving version before creating a release candidate. The endpoint selector serves one version at 100%, while existing sessions stay bound to their version.

Application Insights and OpenTelemetry Protocol destinations operate independently, so configuring both sends telemetry to both destinations. Hosted-agent optimization requires the Responses protocol and subscription allow-list access, and optimizer evaluations invoke hosted tools for real, which makes evaluation permissions and effects part of release planning.

Agent memory and retrieval need enforceable lifecycle controls

The memory and document-ingestion guides treat stored context as governed application data. Authorization, freshness, and deletion require controls before retrieval and persistence, not only instructions to the agent.

Memory writes and retrieval use separate policy gates

The memory architecture separates Remember, Retrieve, Revalidate, and Forget across agents, application policy layers, memory services, and authoritative systems. Durable writes pass through policy gates rather than persisting arbitrary model output, and authorization constrains retrieval candidates before semantic or hybrid ranking. A time to live (TTL) limits storage or retrieval lifetime but does not prove that a stored value remains correct.

The Foundry implementation derives memory scope from authenticated, tenant-qualified identity and uses separate retrieval authorization and write-admission gates. Current Foundry Memory preview documentation states that virtual network integration is not supported for memory stores. The guidance keeps production writes disabled until staging tests demonstrate isolation, prohibited-data rejection, user-visible deletion, trace redaction, and rollback.

Deletion is a workflow rather than a single storage operation. It must disable retrieval, propagate removal across derivatives, retry idempotently, and verify completion through audit evidence.

Document deletion must stop retrieval before cleanup finishes

A self-updating retrieval-augmented generation (RAG) design uses Azure Cosmos DB as the authoritative lifecycle metadata store and Azure AI Search as the retrieval index. Conditional version updates prevent delayed ingestion jobs from activating older document versions, while logical deletion blocks retrieval before asynchronous workers physically remove indexed chunks.

The transactional outbox pattern coordinates lifecycle changes with reliable publication of background jobs. Conventional workers handle these deterministic document operations, leaving Microsoft Agent Framework to support reasoning and tool-based query workflows.

Copilot Studio guidance keeps delegation separate from authorization

Copilot Studio architecture and pilot reports examine what must remain trustworthy as work moves between agents, applications, and approval systems. They also identify preview and validation limits that matter before production use.

Worker handoffs preserve context within bounded domains

A multi-agent design separates a front-door supervisor from specialized workers responsible for bounded domains. It maps supervisor variables into worker input arguments to preserve identity, intent, and extracted entities, and recommends separate Power Platform environments, input sanitization, and Dataverse logging of delegation activity.

Human escalation should carry transcripts, attempted diagnostic steps, and error codes. That gives operators the evidence needed to continue an investigation rather than only receiving the agent's conclusion.

App sharing does not grant organizational data access

The GitHub Copilot harness in Copilot Studio is an orchestration runtime, not the GitHub Copilot service, and app authoring provides an interactive preview with underlying code available for inspection. Sharing an app does not automatically grant recipients access to its organizational data, and sensitive operations require authorization in the backend or data source rather than UI visibility checks.

Apps in Copilot Studio remains a preview with potentially restricted functionality and is not intended for production use. Code inspection and data-source authorization therefore remain important evaluation steps, not proof that the preview is production-ready.

Approval-expiry tests establish limited, specific evidence

An MCP pilot using Microsoft Entra delegated identity and federated connector authentication confirmed zero target writes for a denied proposal and no execution for an expired proposal. An expired-approval withdrawal correction passed the same 89-test suite locally and on Azure Linux.

Approved execution and replay remain unqualified, both pilot identities are operated by one person, and incremental benefit over native controls remains unmeasured. The results support the tested denial and expiry behavior, not a broader claim that the approval system is fully validated.

Vulnerability prioritization combines attack evidence with application context

The prioritization material argues against using severity as the sole patch queue. Real-world exploitation data and dependency-specific evidence answer different parts of the remediation decision.

Exploitation patterns expose gaps in severity-only triage

Microsoft's analysis covers 382,789 published CVEs through September 2026 and 2,056 vulnerabilities exploited in the wild. Server-side remote code execution accounts for 20% of published CVEs but 37% of exploited ones, while takeover vulnerabilities account for 78% of real-world exploited vulnerabilities. Median patching takes about two weeks on Windows workstations, more than a month on Windows Servers, and beyond a year on network appliances.

Defender prioritization combines exploitability signals, breach likelihood, internet exposure, and asset criticality rather than relying only on the Common Vulnerability Scoring System (CVSS). Dependabot guidance applies the same contextual approach to dependencies, recommending usage, vulnerable-code reachability, and production exposure alongside severity and the Exploit Prediction Scoring System (EPSS).

A package-upgrade advisor keeps insufficient evidence visible

A tutorial combines a GPT-4.1 Foundry agent, Grounding with Bing Custom Search, and Microsoft-Decision-1 to assess package upgrades using retrieved evidence. Its example checks Django 4.2.0 against official advisories and asks for fixed versions before assessing upgrade necessity, reason, and urgency.

When the decision model selects insufficient evidence, the application recommends gathering more information rather than treating urgency as actionable. This makes missing evidence an explicit outcome instead of forcing every assessment into an upgrade recommendation.

Private ingress designs require end-to-end validation

The networking guides distinguish a private entry point from complete workload isolation. They also show why DNS, authentication paths, certificates, and backend connectivity need separate checks.

Databricks overlapping-network design has validation limits

A proposed Databricks design places uniquely addressed front-end private endpoints in an enterprise-reachable Transit VNet while keeping overlapping compute networks isolated. Hybrid DNS forwards azuredatabricks.net to an Azure DNS Private Resolver inbound endpoint and must return private endpoints reachable by each client. The browser_authentication endpoint supports browser single sign-on callbacks, not REST API authentication.

Front-end private endpoints do not automatically disable public access, and complete isolation needs additional backend connectivity and workspace configuration. The overlapping-address composition is an architectural inference, not a Microsoft-certified or independently validated reference architecture, and the author claims no deployment or sandbox testing.

Traefik ingress uses separate encrypted connection segments

An Azure Kubernetes Service design connects Azure Front Door Premium to Traefik through Azure Private Link and an internal load balancer. Front Door terminates client-facing Transport Layer Security (TLS) and creates a separate HTTPS connection that Traefik terminates using a Kubernetes TLS Secret.

The deployment uses Traefik Helm chart 41.6.0 with two replicas on a user node pool. Validation covers scheduling, service endpoints, Private Link approval, certificates, routing rules, and end-to-end connectivity rather than stopping at successful component deployment.

Recovery guidance separates containment, restoration, and integrity

Azure's recovery material covers both new backup previews and response procedures for existing database services. A ledger experiment adds a separate lesson: recording changes and verifying history are not the same as preventing an authorized data update.

Azure Files previews independent recovery points and in-place restoration

Azure Files announced public previews for vaulted NFS backups, Revert Snapshot, and Azure Files-to-Azure Files copy and synchronization. Vaulted NFS backups keep recovery points separate from production shares, with policies supporting long-term retention, immutability, and cyber recovery.

Revert Snapshot initially supports SMB shares and restores a selected snapshot without changing the share endpoint or mount path. Azure Storage Mover supports SMB copies across accounts, regions, and subscriptions within the same tenant, including scheduled incremental transfers. NFS support for Revert Snapshot and Azure Files-to-Azure Files copy is planned for later.

Azure SQL ransomware response starts before restoration

Microsoft published a seven-step ransomware recovery framework for Azure SQL Database and Azure SQL Managed Instance: Protect, Detect, Contain, Assess, Restore, Validate, and Harden. It addresses attacks through customer-controlled identities, networks, applications, and configurations, not compromise of the Azure platform itself.

The guidance recommends containing attacker access before restoration, preserving backups and evidence, testing restores, and rehearsing the full response annually. Recovery options include point-in-time restore, long-term retention backups, cross-region recovery, and recovery of deleted resources.

A ledger lab demonstrates recorded changes and digest verification

An Azure SQL ledger experiment recorded a balance change from 250 to 9000 as DELETE and INSERT entries in one transaction, including commit time and Entra identity, while rejecting attempts to modify history, disable system versioning, or update an append-only table. Verification failed against an incorrect digest, and the author recommends automatically storing digests in immutable Blob storage or Azure confidential ledger.

Other Security News

Azure Container Registry's Connected Registry private preview supports user-assigned managed identity synchronization on eligible Azure Arc-enabled Kubernetes distributions, with repository scope controlled by role assignments and attribute-based conditions. Migration is one-way and needs an offline maintenance window, while narrowing permissions requires az acr connected-registry resync and does not remove previously synchronized artifacts.

GitHub Desktop 3.6.10 or later can issue eligible sign-ins short-lived, automatically refreshing tokens during a gradual github.com rollout that excludes GitHub Enterprise Server. Existing tokens are not automatically migrated when users upgrade, so upgrading alone does not shorten an existing token's lifetime.

Environment variables for serverless Azure Databricks jobs remain in Beta, with job-level entries selected explicitly per task rather than inherited or merged. Secret references resolve using the job's Run as identity, but best-effort redaction can leave printed secrets exposed in compute execution logs.

Azure Policy exposes caller identity claims through requestContext().identity, and its denyAction effect currently supports only DELETE, enabling policies that distinguish manual deletion from application requests. Identity-based exemptions are generally available, but creating one requires both write permission and exempt/Action permission on the target assignment.

Azure Local deployment guidance warns that each release is supported for six months and that out-of-band updates to individual components are unsupported. It also identifies Azure Arc extension deployment permissions as privileged code-execution authority, allowing Local System access on Windows or root on Linux.

Microsoft Purview eDiscovery plans three read-only diagnostics for case access, security filters, and hold-policy distribution, without modifying organizational configuration. Worldwide public preview is scheduled for early December 2026, followed by a general availability rollout starting in late December and completing by environment through February 2027, with no immediate administrative action required.

The Azure weekly video covers security-related networking and database topics, including Azure Front Door post-quantum TLS key exchange, Application Gateway for Containers private ingress and JWT validation, and SQL database-level managed identity. It also includes point-in-time recovery backup immutability for Azure SQL Database and Managed Instance.

Also relevant this week

Dates to know

Deadlines