Browse All Security Content (571)

Allison announces general availability of GitHub Code Quality for GitHub Enterprise Cloud and GitHub Team, combining deterministic CodeQL analysis with AI-assisted detection and Copilot Autofix to flag maintainability and reliability issues in pull requests, plus new org-level dashboards, coverage reporting, ruleset-based quality gates, and APIs.

John Edward outlines practical Azure architecture best practices for enterprise applications, covering the Azure Well-Architected Framework, scalability and high availability patterns, security with Zero Trust, observability, infrastructure as code, CI/CD, cost controls, networking, disaster recovery, and governance.

This week's Security roundup connects active threat intel with the platform controls teams can use to reduce exposure. Microsoft detailed ACR Stealer intrusion chains and ShinyHunters-linked OAuth abuse against Salesforce, while a real @asyncapi npm compromise showed how CI misconfigurations and trusted publishing can turn PRs into malware delivery. On the platform side, GitHub shipped more in-PR security signals (AI detections, agentic autofix, and Copilot security review) plus safer supply-chain defaults like Dependabot cooldowns and stronger secret scanning automation. Rounding it out, Entra ID moves to passkeys by default and new guidance focuses on governing AI agents and tool access with least privilege, gateways, and auditable authorization.

Lee Stott invites AI engineers to a Microsoft Foundry Discord round table on using the Browser Automation Tool (BAT) to let agents drive real browser workflows via Playwright Workspaces, with a focus on setup basics, practical use cases, and the guardrails needed for responsible, auditable automation.

Allison announces new controls for GitHub Copilot code review, including reading custom instructions from the PR head branch, expanded instruction file support, repository-level setup steps via a workflow YAML, and a default-on firewall with separate configuration from Copilot cloud agent.

Jordan Selig explains how Microsoft Foundry’s new AI Gateway control plane lets platform teams create or associate an Azure API Management (APIM) gateway from the Foundry admin console, while keeping the runtime on Azure App Service. The post breaks down what Foundry now governs, what still belongs in APIM, and how to adapt an existing App Service agent sample.

Elliot Volkman shares Microsoft Security’s Black Hat USA 2026 agenda, focused on how attackers abuse “trust paths” across software supply chains, identities, cloud services, and AI systems. The post highlights sessions on npm supply chain campaigns, Azure Automation research, GitHub-focused detection ideas, and hands-on skilling with Defender and Sentinel.

VimalVerma outlines Hypervelocity Engineering (HVE) as an operating model for building and continuously evolving Azure AI Landing Zones, with a focus on platform engineering, Infrastructure as Code, Policy as Code, and security-by-design so enterprise AI platforms can scale without losing governance.

Microsoft Security Research and Balaji Venkatesh S break down two ACR Stealer intrusion chains seen in customer environments, showing how ClickFix lures lead to WebDAV- and MSHTA-driven execution, credential theft from browsers via DPAPI, and file staging for exfiltration, with concrete Defender detections, hunting queries, and mitigations.

olivialiu-micro explains how SQL Server 2025 enables governed outbound calls to external AI services while keeping control inside the database security model, including permissions, enablement switches, authentication options, and built-in auditing for REST invocation and external model objects.

Lee Stott invites AI engineers to a Microsoft Foundry Discord round table on scaling agent apps beyond demos, focusing on how Foundry Toolbox, Skills, and Tool Search reduce tool sprawl, prompt bloat, and auth plumbing by centralizing tools behind a governed MCP endpoint with runtime discovery.

Microsoft Developer walks through what’s new in Data API builder (DAB) 2.0, focusing on how it sits between an app and a database to expose APIs without writing custom CRUD endpoints. The overview highlights new secrets management, broader authentication options, improved authorization controls, and integration points.

Yesenia Yser and Toby Kohlenberg explain why AI agents need to be treated as first-class security principals, with tightly scoped roles, controlled tool access, and end-to-end auditability to prevent quiet permission creep and hard-to-investigate incidents.

jordanselig explains the new stable Enterprise-Managed Authorization (EMA) extension for MCP and how it differs from a centrally governed OAuth setup using Microsoft Entra ID and Azure App Service Authentication. The post includes a working sample, a local EMA lab, and practical security details for deploying an Entra-governed MCP endpoint.

Ruben Rios announces a preview of Private Marketplace support in Visual Studio, aimed at organizations that need tighter control over how developers discover and install extensions for security, compliance, and governance reasons.

Suma SaganeGowda explains how Microsoft 365 built COSMIC, an internal platform layer on Azure Kubernetes Service (AKS), to standardize provisioning, deployments, security/compliance guardrails, and observability across globally distributed services so product teams can ship faster without taking on Kubernetes operational overhead.

Microsoft Security Research, Ravikant Tiwari, Sagar Patil, Suriyaraj Natarajan and Arvind Gowda break down a coordinated compromise of the @asyncapi npm organization, where attackers abused a misconfigured GitHub Actions workflow and trusted publishing to ship import-time malware, and they provide concrete indicators, hunting queries, and remediation steps.

Allison summarizes new GitHub secret scanning and public monitoring improvements, including new partner detectors, expanded push protection defaults, a new webhook field to distinguish secret categories, and additional insight cards to help enterprises understand leak attribution and exposure scope.

mk_sunitha explains a secure pattern for calling Microsoft Fabric REST APIs from User Data Functions (UDFs), using a service principal plus Azure Key Vault to keep secrets out of application code while still enabling governed automation like triggering Fabric pipelines and managing workspaces.

Manasa Ramalinga lays out a practical reference map for governing enterprise AI and autonomous agents, focusing on how to turn responsible AI policy into enforceable controls, runtime visibility, and audit-ready proof using Microsoft’s governance, security, and observability services.

Polly Davidson lays out a beginner-friendly roadmap for learning GitHub, from core Git concepts and essential commands to day-to-day collaboration with pull requests, issues, and projects. It also introduces GitHub Actions for CI/CD, GitHub Pages for publishing, and practical security basics like 2FA, secret scanning, Dependabot, and CodeQL.

jordanselig shares a reference implementation for giving an AI agent both short-term conversation history and durable, user-scoped memory on Azure App Service, using Redis for bounded session history and Cosmos DB vector search for recall, with keyless auth via managed identity and a one-command azd + Bicep deployment.

Aarti Borkar announces Microsoft Defender Experts Threat Intelligence and expanded Microsoft Defender Experts MDR coverage, focused on closing the “intelligence-to-action” gap for security teams. The post explains how curated, expert-led intelligence and managed response workflows are being brought directly into the Defender portal and powered by Microsoft Sentinel.

John Edward explains why AI agents that look great in demos often break down in production, and what teams need to engineer around the model to make agents reliable at scale.

GitHub compiles its GitHub for Beginners Season 3 into a single crash course covering core GitHub workflows: planning work with Issues and Projects, automating CI/CD with GitHub Actions, using built-in security features, publishing with GitHub Pages, writing Markdown, and making first open source contributions.

Allison announces a public preview feature where GitHub code scanning surfaces AI-powered security detections directly on pull requests, helping teams catch issues in languages and frameworks that don’t have native CodeQL coverage. The update explains what’s included, how it runs, enablement requirements, and how billing works via AI credits.

akhilkarmalkar announces Azure Front Door edge actions (public preview), a way to run lightweight JavaScript during request processing at Microsoft’s global edge. The post explains where edge actions run in the Front Door pipeline, what scenarios they enable (routing, headers, auth checks), and how Hyperlight micro-VM isolation is used to keep execution secure.

Rahul Bhandari (MSFT) and Tara Overfield recap the July 2026 servicing releases for .NET and .NET Framework, including a list of fixed security vulnerabilities (CVEs) and direct links to release notes, installers, container images, Linux package instructions, and known issues for supported .NET versions.

Allison announces a new default safety behavior in Dependabot: version update pull requests will wait three days after a release appears in its registry, reducing the risk of immediately adopting compromised or broken dependency releases while keeping security updates immediate.

Allison announces a public preview feature in the GitHub Copilot app: the /security-review slash command, which runs an on-demand security review of your in-flight code changes and returns prioritized findings with suggested fixes you can apply and re-check without leaving Copilot.

jisunchoi explains how to replace “multi-model chaos” with a governed AI gateway on Azure using Azure API Management, covering cost controls (token quotas and budget-based model downgrades), security hardening (managed identity + private endpoints), observability with Application Insights, and a Terraform-based deployment you can integrate with GitHub Copilot.

Allison announces generally available GitHub REST API endpoints for creating, updating, listing, and deleting secret scanning custom patterns across repository, organization, and enterprise scopes, with dry runs and publishing still handled in the UI.

Allison announces a new billing estimate view for GitHub Code Quality in public preview, showing active committers and an estimated monthly license cost so enterprises can understand expected charges before general availability.

Microsoft Security Research and the Microsoft Defender Security Research Team break down ShinyHunters-linked campaigns abusing OAuth trust in Salesforce and related SaaS integrations, then map practical detection and governance steps using Microsoft Defender for Cloud Apps, including new Salesforce connector telemetry, posture insights, and KQL hunting queries.

shiv_narayanan summarizes recent Dataverse Fabric Link updates that make it easier to control which Dataverse tables are synced into Microsoft Fabric, improve production-ready authentication options, and reduce sync latency so operational data shows up faster in OneLake-backed analytics workloads.

ofer announces a new OneLake Architectural Guidance whitepaper and summarizes five repeatable enterprise patterns for building a unified, governed data foundation in Microsoft Fabric, aimed at analytics modernization and AI readiness, including data access unification, medallion architecture, governed data mesh, platform simplification, and external data sharing.

sbaynes announces changes to Microsoft Entra ID authentication: passkeys become the default MFA experience starting September 1, 2026, and Microsoft-provided SMS/voice delivery is retired on February 1, 2027. The post explains why phishing-resistant methods matter and outlines concrete admin steps and a rollout timeline.

abhimittal shows how to use Azure API Management (APIM) as an AI gateway in front of Azure AI Foundry to capture per-model token usage for governance. The post walks through an inbound policy that authenticates with managed identity, emits token metrics to Azure Monitor/Application Insights, and adds edge protection with Azure Front Door + WAF.

kinfey shares a reference implementation for running long-lived autonomous coding agents from Microsoft Teams, using MCP as the control plane and Azure Container Apps dynamic sessions as a Hyper-V-isolated sandbox. The post focuses on multi-agent orchestration, deployment reliability under platform timeouts, and practical security guardrails like auth, allowlists, private ingress, and managed identities.

This week's Security roundup centers on making security controls easier to apply at scale, from production-grade guardrails for AI agents to stricter, more automatable supply chain defaults. GitHub and npm updates push publishing toward identity-based workflows (OIDC) and improve coordinated remediation with innersource advisories, while CodeQL and secret scanning add clearer triage and coverage for AI-era risks like system prompt injection. On the Microsoft side, Secure Future Initiative updates show how continuous control validation and crypto readiness (including post-quantum planning) are becoming measurable engineering work, and Azure expands key custody options with external key management for Managed HSM.