Browse All Posts (112)

Emanuele Bartolesi recaps GitHub Universe 2026 through its two keynotes, connecting Copilot’s multi-repository workflows with review, security, and Git infrastructure changes. His practical takeaways focus on verification gates, contributor guardrails, shared planning, and keeping human judgment central as teams adopt coding agents.

Andrew Lock explains how .NET Lazy thread-safety modes control factory execution, value publication, and exception caching. Through C# examples and concurrency diagrams, he compares PublicationOnly with ExecutionAndPublication, discusses their allocation and locking trade-offs, and shows when LazyInitializer offers a simpler alternative without caching exceptions.

Jason Farmer explains how industrial AI agents connect to real equipment through cloud and edge infrastructure. The architecture combines Azure IoT services, Kubernetes, Foundry Local, and Microsoft Fabric, with an on-site virtual coworker that continues operating when cloud connectivity drops.

sbaynes shares how Microsoft's Copilot Cowork team used coding agents, written specifications, automated reviews, and human checkpoints to build and migrate a live service. The article explains practical controls for parallel development, security boundaries, trustworthy tests, and a Python-to-Rust migration, including measured gains and remaining limitations.

Microsoft Security Research, Yair Tsarfaty and Or Begam analyze which vulnerabilities attackers actually exploit and why system-takeover flaws deserve priority. Their findings connect exploitation patterns and patching delays with practical use of Microsoft Defender exposure scores and attack path analysis to reduce risk beyond patching alone.

MichalBar explains how Copilot in Microsoft Fabric generates editable Real-Time Dashboards from natural-language descriptions and Eventhouse data. The preview workflow lets users refine a dashboard plan before creation, then inspect queries and customize visuals. A stadium example connects transit arrivals with gate activity and queue lengths.

Microsoft Developer highlights a browser change that can affect runtime behavior without code changes, Zstd WAL compression for Azure Database for PostgreSQL, and the Copilot Studio Conversation Harness. The update spans browser behavior, database storage savings, and tooling for building customer-facing AI agents.

John Edward outlines the generally available GitHub app for Microsoft Teams, including Copilot task tracking, multi-repository work, and MCP connections. He also explains onboarding and administrator requirements, showing how teams can turn conversations into issues and pull requests while retaining human review of AI-generated changes.

WSilveira collects November’s Azure Logic Apps product and community updates, including a local CLI preview, AI agent orchestration, pricing allowances, and hybrid storage benchmarks. The newsletter also points developers to secure Foundry integrations, C# workflow tooling, Fabric real-time analytics, deployment walkthroughs, and BizTalk migration guidance.

Allison explains how GitHub’s code security and secret risk assessments now distinguish findings in protected and unprotected repositories. The update helps organization admins and security managers identify gaps in security coverage, with availability in GitHub Enterprise Cloud and GitHub Team and planned secret assessment support in Enterprise Server 3.24.

Allison outlines GitHub Actions’ upcoming default block on pull_request_target events in public repositories, with enforcement moved to December 2, 2026. Two November brownouts will help maintainers identify affected workflows. The update explains how to review blocked runs and explicitly permit workflows while accounting for risks to repository secrets.

Visual Studio Code shows how to move between the editor and Agents Window without losing context. This short focuses on navigating between coding and AI agent interactions within the development environment.

Samantha_Fernandez introduces Azure portal support for AKS flex nodes in preview, covering pool creation, supported host onboarding, and Kubernetes workload placement. The walkthrough explains how to connect user-managed compute across regions, on-premises, or at the edge, while retaining responsibility for host security, connectivity, and preview requirements.

John Savill reviews Microsoft's October 2026 AI updates, covering foundation models, inference hardware, and agent capabilities. The overview also covers GitHub Copilot features, including session continuity and code review, alongside Azure API Management integration and broader changes to Microsoft's AI tooling.

John Edward explains how Microsoft Copilot Studio flags agents that have never been evaluated or whose models have changed since their last evaluation. The automatic Review panel warnings link makers to evaluation tools without blocking publishing, helping teams identify when previous test results may no longer reflect current agent behavior.

Azure Arc Automatic Agent Upgrade is now generally available, letting teams automate Connected Machine agent maintenance through Azure Policy and onboarding settings, while Azure Advisor flags disconnected servers before certificate expiration forces re-onboarding. Azure Cloud HSM is rolling out hardware audit logging with independently verifiable signed records, giving security teams evidence of supported management and key operations. Developer tooling adds deployment inspection through `azd deploy --preview`, a public-preview local CLI for Logic Apps Standard, and the first stable Cosmos DB SDK for Rust, which requires migration changes for preview users. Foundry Agent Service introduces the Microsoft Copilot harness in public preview and makes long-running resilience generally available, although applications must still save progress and prevent duplicate actions after restarts. Together, these updates emphasize automated operations and reviewable deployment and security workflows

GitHub Agentic Workflows is now generally available, turning natural-language Markdown into GitHub Actions workflows with read-only default permissions, sandboxing, and validated outputs. Copilot Fusion and paid-plan Copilot Memory also reached general availability, while agent sessions can now continue across editor, CLI, web, and mobile clients, giving teams more persistent context and continuity across repositories. Azure Arc Automatic Agent Upgrade reached general availability, Azure Developer CLI added deployment previews and extension-aware pipeline generation, and Azure DevOps Server 26H2 RC opened a supported path for upgrade testing. Marketplace Trusted Publishing lets extension publishers replace long-lived tokens with temporary or federated credentials, while PHP2Shell guidance makes clear that customers must patch PHP installed by pipeline steps or bundled in custom images. The week's releases pair broader agent automation with explicit permissions, release validation, and

Microsoft introduced Project Osmos for Fabric, which coordinates data engineering agents and runs persistent PySpark tasks after local assistants disconnect, with execution governed by user permissions and Fabric capacity consumption. OneLake catalog's Govern experience became generally available, centralizing estate-wide oversight, while preview policies add explicit controls over who can edit governed workspace settings. Paid GitHub Copilot users in VS Code can now choose low, medium, or high eagerness for Next Edit Suggestions, balancing smaller interruptions against more extensive proposed edits. Fabric Data Warehouse added preview Python function calls from T-SQL and workspace-level query monitoring, while local Qwen3.8-27B testing showed that higher request concurrency can reduce completed agent work. Together, these developments emphasize persistent agent execution backed by access controls, runtime monitoring, and workload-specific tuning.

.NET 11 is ready for serious production validation, while its opt-in Runtime Async preview moves async transformation into the runtime and requires checks for compatibility with reflection-based instrumentation and profiling agents. Infragistics made more than 50 Blazor controls MIT-licensed, and Syncfusion contributed a free MIT-licensed toolkit alongside framework and scaffolding fixes that address rendering, validation, and Identity page behavior. Azure Core 1.63.0 adds mutual TLS proof-of-possession support for .NET authentication, while Visual Studio 2026 adds working-tree comparisons against historical commits, bulk conflict resolution, and opt-in session preservation. Performance benchmarks reinforce the need to test correctness alongside speed, particularly when adopting span iteration or replacing Task with ValueTask.

Azure Cloud HSM Hardware Audit Logging is rolling out across public regions, giving security teams searchable operational records and hardware-signed audit batches they can independently verify. Investigations into malicious Claude Code-branded Cursor extensions and help desk impersonation show why remediation must address persistent SSH artifacts, privileged certificates, and previously issued Kerberos tickets rather than stop at the initial entry point. Marketplace Trusted Publishing introduces publishing without long-lived personal access tokens, while GitHub Copilot's server-to-server authentication preview gives organization-installed apps short-lived credentials governed by organizational policies and budgets. GitHub Agentic Workflows and Copilot assisted permissions reached general availability with execution safeguards and approval controls, while Dependabot's reachability preview adds call-path evidence for vulnerability prioritization and Copilot's security extension previews

GitHub Agentic Workflows is generally available, letting developers compile natural-language Markdown into GitHub Actions workflows with read-only defaults, sandboxing, and validated outputs to constrain agent changes. Microsoft Foundry introduced the Copilot harness in public preview, while long-running hosted-agent resilience and browser automation reached general availability, though applications still need to save progress and prevent duplicate actions after restarts. Fabric introduced Project Osmos for persistent, permission-bound data engineering tasks and made the OneLake catalog Govern experience generally available, connecting agent execution with centralized governance. Evaluation and security findings reinforce the need to verify outcomes rather than trust plausible responses, with Microsoft's code-transformation work combining agents with testing and formal verification, and Prompt Shields demonstrations blocking malicious instructions in both user input and tool responses.

GitHub Copilot Fusion is now generally available on all Copilot plans, automatically selecting and orchestrating models for individual task steps with configurable effort levels and enterprise model restrictions. Copilot Projects entered public preview for coordinating agents across repositories and connected tools, while VS Code's Agent Host Protocol 1.0 separates agent sessions from editor windows and lets cloud sessions continue across clients. Copilot Memory reached general availability on paid plans, and shared Copilot Automations began rolling out as repository-owned workflows that persist when their creators leave. GitHub Enterprise Cloud customers working with an account team can now receive Copilot access for every licensed user, but that access includes no monthly AI credits, while new permission and plugin controls give administrators more control over agent execution. Together, these releases extend Copilot from individual coding assistance toward persistent, shared agent w

GitHub walks through the GitHub Universe 2026 badge’s built-in games, apps, and custom digital profiles. The video also shows how to use GitHub Copilot for setup help when adding community games from Ashley Wolf’s repository, including installing the classic Microsoft 3D Maze screen saver on the badge hardware.

ibrahimbaig explains how to build repository-scoped, ephemeral GitHub Actions runners using Azure Container Apps Jobs and KEDA. The guide covers private Key Vault access, GitHub App authentication, separate OIDC deployment identities, lifecycle validation, and the cold-start trade-offs of installing tools at runtime rather than using pre-baked images.

Carlin Cherry explains how reachability analysis follows call paths to determine whether an application can invoke vulnerable dependency code flagged by Dependabot. The short introduces reachability as one signal for prioritizing vulnerabilities, alongside severity, EPSS, and production context, rather than a standalone basis for deciding what to fix.

John Edward explains an upcoming Microsoft Graph change that makes Threads the default layout for newly created Teams channels when layoutType is omitted. The article shows how developers can preserve Posts through explicit API configuration and outlines checks for scripts, provisioning applications, and third-party integrations before the November rollout.

John Edward covers the general availability of automation flow evaluations in Microsoft Copilot Studio. The capability extends structured quality assessment beyond agents to automation flows, helping makers assess expected outcomes and identify issues before production. The article also outlines repeatable evaluation practices and explains why no immediate administrative action is required.

Microsoft Security Research analyzes a malicious Claude Code-branded extension distributed through Cursor’s marketplace, detailing its attempted SSH backdoor and cross-platform persistence. The article provides Microsoft Defender detections, hunting queries, and remediation steps, explaining why removing the extension alone does not eliminate unauthorized keys and startup artifacts.

Microsoft Developer demonstrates Intelligent Terminal running a 120-billion-parameter model locally on Surface hardware with NVIDIA RTX Spark N1X and 128 GB of unified memory. The demonstration covers completing workflows such as writing new agent skills with context, without sending requests to the cloud.

Kristen Womack reviews October’s Azure Developer CLI releases, covering deployment previews, Container Apps express support, environment value removal, and extension-aware pipelines. The recap also explains stable extension APIs, breaking Go API changes, reliability fixes, and new templates for deploying semantic search and streaming AI applications to Azure.

John Savill reviews this week's Azure updates, covering Container Apps logging, confidential VMs, network security, storage quotas, and cross-tenant backup restore. The Halloween edition also covers Azure AI Foundry model cost management, Azure MCP Server 3.0, new model topics, and GitHub Universe.

Microsoft Security Research, Sagar Patil, Jesse Birch and Tal Tzhori examine two intrusions that escalated from help desk impersonation to AD CS certificate abuse. Their analysis explains ESC1 and ESC8 attack paths, contrasting containment outcomes, and practical Microsoft Defender hunting queries and hardening measures for certificate-backed identity compromise.

Michael MacKenzie, Microsoft’s VP of Product Management for Azure IoT and Digital Operations, explains how physical AI differs from traditional automation: automation repeats a task, while physical AI gets smarter each time it runs. This short introduces the distinction as part of a broader conversation on IoT and physical AI.

yunishussein explains how Azure Advisor identifies disconnected Azure Arc-enabled servers before their agent credentials expire. The guide covers heartbeat and certificate thresholds, recommended recovery actions, and ways to review affected machines through the Azure portal or query recommendations across subscriptions with Azure Resource Graph.

Microsoft Developer explores model selection using the Microsoft Foundry model catalog. By swapping only the model deployment and running the same evaluation on both options, the episode compares results alongside measured cost and latency to show when a smaller model is suitable for production and when it is not.

Visual Studio Code demonstrates how to use IntelliSense and GitHub Copilot to write, explain, and improve PostgreSQL queries without switching tools. The workflow also covers running queries and validating their results directly in the editor.

Waldek Mastykarz examines whether naming a workspace folder ‘eval’ changes GitHub Copilot CLI behavior. Across about 900 runs with four models, the name increased agents’ suspicion that they were being tested without producing statistically significant behavioral differences. The analysis explains the experiment’s controls, limitations, and practical guidance for evaluation harnesses.

John Edward covers the general availability of Microsoft Copilot Studio's tool accuracy grader, which evaluates whether AI agents select the correct tools and supply expected inputs. The feature adds execution-level checks to agent testing, while leaving response quality, downstream outcomes, and connected-system reliability as separate evaluation concerns.

Maggie Appleton, Martin Woodward, and Jocelyn Velarde close GitHub Universe 2026 with open-source perspectives and coding demos. The session explores learning with GitHub Copilot, scaling projects with AI agents, and collaborative AI planning, alongside creative experiments that highlight the craft of coding and building together.

GitHub puts attendees at GitHub Universe 2026 on the spot with three Git trivia questions. The video tests knowledge of repository forks, git blame, and blob objects, offering a quick check of familiarity with version control commands and the internal objects Git uses to store content.