Browse All Security Content (439)

ryanjadams introduces Microsoft Fabric Connection Recency (preview) and the related REST APIs for auditing and governing connections at enterprise scale, including how to identify stale and duplicate connections and reduce ownership risk using role assignments and Entra group ownership.

Microsoft Security Research (Noam Kochavi and Sarah Wolstencroft) explains how “ASCII smuggling” with invisible Unicode tag characters moved from AI prompt-injection research into real-world phishing evasion, and shares practical detection and mitigation guidance for email defense pipelines.

Allison summarizes what’s new in CodeQL 2.26.4 for GitHub code scanning, including language support updates and query accuracy improvements that affect security detections across C#, Java/Kotlin, and GitHub Actions workflows.

dotnet covers the production-readiness pieces for an AI agent, focusing on observability with OpenTelemetry, governance and data protection with Microsoft Purview, and quality evaluation as the SDK evolves, then shows how to deploy the agent to Foundry Hosted Agents and maintain it with a refresh-prompt workflow.

Microsoft Security Research, Sagar Patil, Arlette Umuhire Sangwa, Jesse Birch and Ravikant Tiwari break down a hands-on-keyboard intrusion that starts with Microsoft Teams helpdesk impersonation, escalates through remote-control sessions and a malicious MSI, and ends with Node.js-based persistence and WinRM lateral movement, with concrete mitigations and Defender XDR hunting queries.

ryanjadams explains how to keep Fabric Data Factory pipelines and Copy Jobs fully private when moving data to or from Snowflake, using Workspace-level Private Link, a private Azure Storage staging account, and Snowflake’s Azure Private Link storage integration.

Allison announces general availability of content exclusion support in the GitHub Copilot app and Copilot CLI, so enterprise, organization, and repository admins can prevent Copilot from using specified files as context and better protect sensitive code during agentic workflows.

Alex-wdy explains an upcoming Azure Key Vault control plane API retirement and the required tooling upgrades to avoid breaking vault management operations. The post lists minimum Azure CLI and Az PowerShell versions, how to check what you have installed, and the exact upgrade commands to run before the February 27, 2027 deadline.

gurjsing shows how to turn Microsoft’s published compliance scope (using Germany’s C5 as the example) into enforceable Azure controls by extracting the certified-service list from the Service Trust Portal, mapping it to ARM resource types, and deploying a deny/audit Azure Policy with a reviewable, automated workflow.

Microsoft Security Research, Microsoft Defender Experts and Parth Jomadkar document a malware campaign that uses look-alike software download sites and regenerated installer archives to compromise Windows systems. The post breaks down the attack chain, provides Defender XDR detections and KQL hunting queries, and lists practical mitigations and IOCs defenders can apply.

Michaela Isaacs explains the GA transition in Power BI and Microsoft Fabric from embedded ODBC drivers to Apache Arrow Database Connectivity (ADBC) drivers, why it improves large-result performance and security posture, and how to validate the change ahead of the tenant-wide cutover.

bgautam announces general availability of the Microsoft Fabric Admin API for listing workspace networking communication policies tenant-wide, aimed at improving security auditing, compliance monitoring, and governance reporting across Fabric workspaces.

Microsoft Defender Experts Cybersecurity Incident Response describes Microsoft DART’s Cybersecurity Incident Response Readiness Workshop, a scenario-driven engagement that stress-tests incident response plans with realistic attack simulations, threat hunting exercises, and feedback on how people, process, and telemetry hold up under pressure.

Nimrod Shalit introduces a new set of Microsoft Learn resources for implementing CI/CD in Microsoft Fabric, covering platform concepts, best practices, and hands-on tutorials for deploying Fabric items across dev/test/prod using Git integration, Azure DevOps pipelines, Terraform, the Fabric CLI, and the fabric-cicd library.

Karen Lopez explains how Dynamic Data Masking in Microsoft SQL can protect sensitive fields while keeping data usable for day-to-day work. She focuses on the new regex-based masking support, how masking works in practice, and the trade-offs versus encryption, including common pitfalls like ad hoc query access.

Nicolas Mondada announces the GA release of Certificate Management for Azure Arc-enabled Kubernetes, a Microsoft-managed extension that automates TLS certificate issuance/renewal and trust bundle distribution across edge fleets, including support for disconnected operation, broad distro validation, and ARM64 edge hardware.

John Edward covers a Copilot Studio authentication update that adds Microsoft Entra ID-based identity for both delegated user access and service-to-service (S2S) scenarios, aimed at making enterprise agent deployments easier to secure and integrate with existing applications.

John Edward summarizes Microsoft’s warning that firewall, proxy, and TLS inspection setups can break Windows Update connectivity, leaving devices without security patches. The post explains the certificate trust model behind Windows Update, why wildcard FQDN allowlists matter, and how admins can use PowerShell and audit logs to confirm the issue before changing network rules.

bytecascade explains how Microsoft Fabric Eventstream can securely ingest private operational data (like factory MQTT telemetry) for real-time analytics by using an Azure virtual network bridge and a Fabric streaming virtual network data gateway, without exposing public endpoints.

FabSubhojit announces the general availability of Fabric Migration Assistant for SQL database, a guided workflow for assessing schema compatibility, provisioning SQL database in Fabric, deploying schema with fix suggestions, and copying data. The update adds a Validate step that analyzes a DACPAC before any Fabric resources are created.

anishta announces GA support for sending Azure Service Bus messages directly from Azure API Management using the send-service-bus-message policy, turning APIM into a governed HTTP front door for asynchronous workloads. The post explains message property controls, failure-handling options, and securing access with Microsoft Entra managed identity and Azure RBAC.

Lily Ma explains how to extend Azure SRE Agent with operational tools by hosting Model Context Protocol (MCP) servers on Azure Connector Namespace. The post walks through deploying an Azure SQL MCP server with azd, wiring it into SRE Agent as an MCP connector, and securing access using managed identity.

Sudha Mahajan introduces Azure Multicloud Interconnect, a jointly engineered Microsoft and AWS managed service for private, high-throughput connectivity between Azure and AWS, aimed at reducing the operational complexity of stitching together ExpressRoute, Direct Connect, routers, BGP peering, and encryption.

sbaynes announces a Microsoft/AWS collaboration that streamlines private, high-performance connectivity between Azure and AWS using standardized OpenAPI-based interoperability, with an emphasis on operational simplicity, predictable bandwidth, and built-in security features like MACsec.

John Edward lays out a practical checklist for taking an AI agent from demo to production using Microsoft Copilot and Azure AI Foundry, focusing on architecture choices, grounding with enterprise data, controlled tool permissions, evaluation, monitoring, and cost/latency controls.

This week's Security roundup focuses on how attackers and defenders are converging on the same idea: the control points between users, automation, and your internal network matter as much as endpoints. Microsoft Threat Intelligence detailed ClickFix (TerminalFix) tradecraft and a second wave of intrusions aimed at exposed AI gateways and orchestration layers, reinforcing priorities like tightening script execution, monitoring egress, and treating AI infrastructure like production identity and networking. On the defensive side, guidance and platform updates emphasized repeatable guardrails for agentic AI (verification, governed tool access, tracing, and secret boundaries), plus practical improvements in tenant governance and managed response coverage. We close with supply chain and collaboration controls, including GitHub moderation updates and evaluation patterns for LLM-based security workflows that help teams scale trust signals without losing auditability.

jkordick lays out a practical framework for verifying agentic AI output in application modernization work, focusing on how to replace “looks good to me” with layered checks that produce concrete, actionable results for reverse engineering and code generation.

Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan break down the TerminalFix (ClickFix) intrusion chain, where a fake Cloudflare CAPTCHA leads users to run PowerShell that triggers DLL sideloading, steganographic payload delivery, Active Directory recon, and a Python reverse WebSocket tunnel, plus Defender detections and hunting queries.

Microsoft Developer walks through the practical work needed to take an AI agent from prototype to production using Azure AI Foundry and Microsoft Agent Framework, including model selection, MCP-based prompts, tool calling, tracing, evaluation, monitoring, and governance guardrails.

sbaynes breaks down three concrete architecture choices PONS made to build a legal AI platform on Azure for regulated customers: separating public legal knowledge from private client data, leaning on managed Azure services to reduce ops overhead, and turning compliance requirements into enforceable technical controls.

goupadhy announces the August 2026 on-premises data gateway release (version 3000.330), highlighting Power BI Desktop compatibility plus updates across security, authentication, diagnostics, and reliability, along with guidance to upgrade to stay current with dependency and CVE-related fixes.

Lauro Ojeda compares self-hosted PostgreSQL with managed PostgreSQL services on Azure, focusing on what you gain and give up around control, operational effort, resilience, security, and cost predictability. It includes a practical checklist to help teams decide which operating model fits their requirements and constraints.

Allison announces a GitHub moderation improvement that lets you automatically close all open issues, discussions, and pull requests authored by a user when you block them in a personal account or organization.

Peter Steinberger and the OpenClaw maintainers discuss how they scaled a viral open source project on GitHub, including handling large volumes of pull requests, setting up governance, and meeting enterprise security expectations while keeping the project model-neutral.

Gregg Cochran shares lessons from OpenClaw’s maintainers on what changes when an AI-driven open source project scales fast: how pull requests turn into “prompt requests,” what new trust signals look like, and how to reduce supply chain risk while keeping agent capabilities safe by default.

Alym Rayani rounds up August 2026 updates across Microsoft Security, including expanded Microsoft Defender Experts coverage via Microsoft Sentinel, new Microsoft Entra Tenant Governance capabilities, Intune endpoint-management improvements, higher-throughput Purview auto-labeling, and new Secure Now guidance for containing agentic activity.

Wes Steyn shows how to take a Microsoft Agent Framework “claw” from a working local prototype to something you can actually run for other people: one shared agent factory feeding multiple hosts, with OpenTelemetry observability, Purview governance, Foundry hosting, and repeatable evals for quality and regression checks.

John Naguib lays out a practical architecture for building self-improving AI agents on Azure, focusing on controlled feedback loops (evaluate, learn, test, approve) rather than uncontrolled self-modification. The guide covers agent runtime, tool calling, RAG, memory/experience stores, evaluation, observability, and governance for production use.

AbhinavPremsekhar explains how to run authenticated browser workflows for Azure AI Foundry agents without exposing credentials to the model, using Browser Automation Tool (BAT) with Playwright Workspaces and Azure Key Vault. The post focuses on secret storage, RBAC access, just-in-time retrieval, and practical security guardrails.

tejabhutada explains how to sync multiple Azure DevOps organizations into a single ServiceNow instance without forcing teams onto a shared Azure DevOps process, outlining common multi-org scenarios, what to evaluate (filters, mappings, conflicts, security), and practical implementation options from webhooks to Azure-based middleware.