Browse All Security Content (451)

Wiliam_Rosa explains how Azure Databricks cross-engine ABAC enforces Unity Catalog row filters, column masks, and ABAC policies for external Apache Spark reads by routing queries through a Databricks-managed serverless enforcement layer, including required metastore settings, grants, Spark configuration, known limitations, and cost tracking.

Michael Scovetta summarizes Microsoft and NVIDIA’s guidance on managing risk when deploying open-weight AI models, focusing on how risk depends on the model, use case, deployment architecture, and safeguards, and how to connect risk categories to evaluations and controls.

abhilashasr threat-models Azure MCP Server for AI-assisted incident response, focusing on how Entra ID, Azure RBAC, Key Vault, Policy, and monitoring controls prevent an assistant from turning diagnostics into unintended production changes. It also includes a read-only demo connecting GitHub Copilot in VS Code to Azure Monitor and Log Analytics.

Allison announces general availability of GitHub’s open source license compliance for GitHub Enterprise Cloud, adding enterprise-wide license policies and PR checks to help teams prevent non-compliant dependencies from being merged.

Jesse Houwing breaks down how real-world supply chain attacks have abused GitHub Actions workflows, then walks through the platform changes GitHub shipped in 2025–2026 (from safer pull_request_target behavior to lock files and cache controls) and ends with a practical checklist of hardening steps to apply now.

Allison announces a new GitHub Code Quality billing feature that lets organizations download a CSV report of license usage, including which active committers consumed licenses, which repositories they contributed to in the last 90 days, and whether committers are unique to a repo or org.

Greg Mohler explains how GitHub built “Evergreen”, a GitHub App that automates quarterly outside-collaborator access reviews and stale-repo archival using native GitHub features like Actions, issues, webhooks, and custom properties, with a fail-secure approach and an audit trail stored directly in git history.

Allison announces general availability of GitHub’s AI Scan for pull requests, an AI-powered code scanning capability that complements CodeQL by detecting vulnerabilities in PR changes (including languages and file types CodeQL may not cover) and surfacing advisory findings with explanations and suggested fixes.

Allison announces general availability of agentic autofix for GitHub code scanning alerts, where Copilot explores the codebase, proposes and validates fixes with CodeQL, and opens a draft pull request. The post also covers where it can be used, required policies and permissions, and how billing works with AI Credits and Actions minutes.

John Edward explains an upcoming Microsoft Entra default-permission change that lets ordinary users create agent blueprints unless admins disable it. The post breaks down what’s changing, what isn’t, and the specific Entra admin center setting IT teams should review before the November 2026 rollout.

John Edward explains the planner-executor loop as a practical architecture for building agentic systems on Azure, focusing on how to separate planning from execution, validate model outputs, and run tool calls safely. The article maps the pattern to Azure services and highlights reliability, observability, and access-control decisions needed for production use.

dchelupati explains how to scale Azure SRE Agent from a single team to enterprise-wide use, focusing on access control, guardrails, auditing, multi-agent topologies, and “agent as code” practices for repeatable deployment and governance.

dchelupati shares a practical “start small” adoption guide for Azure SRE Agent, focused on picking a first operational use case, connecting only the required context (telemetry, repos, runbooks), and expanding into repeatable workflows with the right triggers and permissions.

Meagan McCrory explains that Extended Security Updates (ESU) for Windows Server 2012 and 2012 R2 ended on October 13, 2026, and outlines practical next steps to reduce security and compliance risk by upgrading, migrating to Azure, or modernizing workloads.

Sandeep Sen announces the stable Azure MCP Server 3.0 release and explains what’s new for bringing Azure operational tooling into MCP-compatible AI agent workflows, including Terraform and Advisor tooling, more predictable client integration, and security-focused defaults for resource creation.

Taylor Cuilty explains how GitHub redesigned repository star history to return trends (daily counts) without exposing stargazer identities, while also cutting database load dramatically by filtering by time range before aggregating.

sbaynes reports on Microsoft and partners disrupting a Chinese-language cybercrime marketplace behind large-scale phishing and scam campaigns, including YAM Store, CoGUI, and Iron Man. The piece explains how criminals bought accounts, hosting, and ready-made impersonation templates, and outlines the legal and technical steps used to seize domains and disable accounts.

sukkaur announces a preview feature that enables workspace-level Private Link connectivity for SQL database in Microsoft Fabric, aimed at tightening network access and reducing exposure by keeping database traffic on private networking paths.

Microsoft Developer demonstrates an end-to-end workflow for building and shipping a hosted AI agent from the terminal using GitHub Copilot CLI and Microsoft Foundry, including planning, resource creation, model selection, evaluation-driven improvements, and a secure Azure Functions proxy to connect the agent to a website chat experience.

Allison announces a public preview for GitHub Actions workflow dependency lockfiles, aimed at making workflow runs reproducible and reducing supply-chain risk from moved tags/branches or compromised actions. The post explains how to generate and maintain `.github/workflows/actions.lock`, and how admins can enforce lockfile usage with a new policy.

Microsoft Threat Intelligence and Microsoft Digital Crimes Unit detail how a Chinese-language phishing-as-a-service ecosystem (Storm-2990 and Storm-3119) monetizes compromised Microsoft 365 and Azure for Education tenants, then provide practical mitigation guidance and Microsoft Defender detections to help organizations reduce phishing-driven account takeover risk.

John Edward breaks down how to design stateful AI agents that can keep context across interactions, safely call external tools, and coordinate multi-step work with structured planning. The article focuses on practical system design: what to store, how to retrieve it, and how to control execution so agents behave reliably in production.

Allison announces a set of GitHub Apps updates focused on least-privilege access and easier administration, including new fine-grained permissions for repository creation and installation management, improved controls for adding approved apps to repos, and changes to token and credential handling for GitHub Apps.

sbaynes outlines how Microsoft is scaling Azure’s AI infrastructure end-to-end, covering custom silicon (Maia and Cobalt), networking for large AI clusters, and datacenter power and cooling redesigns. The post also highlights hardware-rooted security work like Azure Integrated HSM and the open-source Tessera Integrated HSM initiative.

sbaynes explains what changed when an AI agent moved from summarizing production network incidents to proposing (and potentially executing) real fixes, and why “safe autonomy” needs multiple deterministic layers rather than a single guardrail.

Allison announces new GitHub audit log events that let organizations and enterprises track manual dismissals and reopenings of GitHub Code Quality findings, including who performed the action, when it happened, and which repository, rule, and findings were affected.

Batu Ozturkler explains how GitHub Secret Scanning reduced false positives and sped up scanning by replacing an LLM-based stage with a compact, fine-tuned ModernBERT classifier that uses surrounding code and text context to decide whether a candidate string is a real credential.

mk_sunitha introduces Fabric App functions (preview), a TypeScript-based serverless capability for Fabric Apps that lets builders run secure server-side logic, use application authentication to access downstream resources, and manage secrets safely. The post also shows how to scaffold, debug, and deploy functions, including using GitHub Copilot in VS Code.

Mark Russinovich and Saurabh Dighe announce Project Tessera, an open-source evolution of Azure Integrated HSM, and explain how its integrated HSM model and protocols aim to improve key protection, interoperability, and post-quantum readiness—plus how the same firmware stack can extend into confidential computing environments.

Allison announces updates to GitHub secret scanning: new detectors for Salesforce, Anthropic, and Cloudsmith, plus expanded push protection defaults that block commits containing Anthropic API keys when secret scanning is enabled.

sergeig888 announces the general availability of Microsoft Fabric “My workspace” governance improvements, including new admin REST APIs for granting and revoking temporary admin access and guidance for restoring orphaned workspaces after a user is deleted in Microsoft Entra ID.

Bryankel summarizes six open-source hardware security innovations announced at the Open Compute Project Global Summit, covering workload-attached HSM design (Tessera), integrated TPM in the BMC, whole-system attestation (Composite EAT), hierarchical bare-metal management, streaming-boot recovery, and Caliptra 2.2 silicon hardening with post-quantum crypto support.

Allison announces updates that make it easier to detect when Dependabot alerts have been withdrawn, including a new webhook action and a clearer REST API response for removed alerts.

Allison announces new Security Overview metrics for GitHub code scanning AI Scan on pull requests, helping org and enterprise admins track findings generated and resolved, remediation rate, repo-level trends, and how often developers apply autofix suggestions.

Allison announces new GitHub Copilot enterprise managed telemetry controls that let admins attribute Copilot activity to a specific user while keeping prompts, responses, and tool content disabled by default, with fine-grained OpenTelemetry capture settings across Copilot CLI, the Copilot app, and VS Code Agent Host sessions.

Rahul Bhandari and Tara Overfield recap the October 2026 servicing releases for .NET and .NET Framework, highlighting security and non-security fixes and pointing to the official CVE lists, release notes, installers, container images, Linux package guidance, and known-issues pages for supported versions.

GisliGudmundsson shares a reference pattern for running Azure AI Foundry workloads inside a secure Azure landing zone, using private endpoints and private DNS zones, disabling local auth in favor of managed identity, and placing Azure API Management in front to enforce token limits and emit token usage metrics.

Allison announces a limited public preview feature that durably records the authenticated GitHub user who pushed each commit, and exposes that pusher identity in the UI and API. It also adds a ruleset condition to block pushes where committer metadata doesn’t match the pusher’s verified emails.

Allison announces a new Dependabot option that lets organizations configure private registries with Anonymous authentication, useful for internal mirrors that allow unauthenticated reads while still working within GitHub.com’s egress allowlist and registry access controls.

John Edward explains a planned Microsoft Entra ID change that lets users register passkeys and other passwordless methods as their first MFA option, removing the previous requirement to set up SMS or voice first. The post outlines rollout phases and what admins should review in Conditional Access and authentication method policies.