Browse All Security Content (452)

Tomoko Tanaka shows how her team turned event marketing runbooks into “ops as code” using GitHub Issues, GitHub Actions, and GitHub Copilot. The post breaks down the repo patterns (issue forms, labels, skills in Markdown, and a DRY_RUN switch) that automate setup, daily screening, and post-event reporting with guardrails.

Allison announces a public preview that adds GitHub REST API endpoints for enabling and managing GitHub code scanning’s AI Scan for pull requests at both the organization and repository level, making it easier to roll out AI-powered security detections across selected repos without manual UI configuration.

Allison announces GitHub Actions cache-mode, a generally available workflow/job setting that lets teams apply least-privilege access to the Actions cache and reduce cache poisoning risk by controlling whether jobs can restore and/or save caches.

Microsoft Security Research breaks down a large-scale business email compromise campaign that used AI-assisted executive impersonation and fake invoices to push finance teams into fraudulent ACH payments, and maps practical mitigations using Microsoft Defender for Office 365, Defender XDR, and Security Copilot.

Steve Sweetman explains how to govern AI agent spend in Microsoft Foundry by combining request-path token limits, observability (traces, monitoring, evaluations), and finance-grade budgets, then tying those signals to ROI so teams can decide what to optimize, scale, or retire.

Maria Bledsoe outlines how Azure IaaS resiliency is shifting from one-time DR planning to continuous design-and-operations practices, highlighting new and updated Azure capabilities for assessing resiliency posture, reducing blast radius during failures, and validating recovery readiness.

Rob Lefferts explains how threat actors are using AI brands (like ChatGPT, Copilot, DeepSeek, and Claude) as social-engineering bait, and how Microsoft Defender helps detect and disrupt these campaigns across email, identity, endpoints, and SaaS signals.

Thomas Maurer introduces the new digital sovereignty adoption guidance in the Microsoft Cloud Adoption Framework, explaining the sovereign cloud continuum and a practical three-phase path (planning, architecture/governance, and operations) for building and running controlled Azure workloads across public, private, and partner cloud models.

Microsoft Developer explains why Dynamic Client Registration becomes a scaling problem for MCP clients, and how switching to Client ID Metadata Documents turns the client_id into a durable, URL-based identity that servers can fetch on demand.

Den Delimarsky explains how MCP authorization evolved, covering the original OAuth profile, protected resource metadata, changes to client registration, and how enterprise-managed authorization fits into the model.

Allison announces a new npm security protection: after signing in with a recovery code, any npm account is placed under a 72-hour security hold that blocks publishing and other sensitive write actions while still allowing sign-in and package installs.

Allison announces CodeQL 2.27.0, highlighting native Linux ARM64 support, improvements to GitHub code scanning default setup, and multiple query and framework-modeling updates that improve vulnerability detection across C#, Java/Kotlin, C/C++, and Rust projects.

Microsoft Security Research and Lior Leizerovich introduce the Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework for understanding and prioritizing threats against cloud-hosted web apps and serverless platforms, with practical examples spanning identities, deployment pipelines, managed runtimes, and connected cloud resources.

Allison announces generally available enterprise managed permissions for GitHub Copilot agent operations, letting admins centrally decide which actions are blocked, require human approval, or run without prompting across supported Copilot clients.

ellievail announces general availability of user-bound user delegation SAS for Azure Storage, which restricts a user delegation SAS token so it can only be used by a specific Microsoft Entra ID identity. The post explains how it works with RBAC, cross-tenant scenarios, and how to generate and share tokens safely.

Sudha Mahajan explains how Azure Migrate Network Planning adds network-aware discovery and assessment to VMware lift-and-shift migrations, helping teams capture dependencies, translate source constructs into Azure networking recommendations, surface readiness issues, and include network costs and security intent in the migration business case.

Microsoft Security Research and co-authors document an intrusion pattern where passkey-themed helpdesk lures lead to identity compromise, MFA persistence, Microsoft Graph reconnaissance, and large-scale data collection from SharePoint, OneDrive, and Exchange Online, with practical hunting queries and mitigation guidance for defenders.

Allison announces expanded self-serve trial eligibility for GitHub Advanced Security on GitHub Enterprise Cloud, allowing more enterprises to evaluate GitHub Code Security and GitHub Secret Protection before purchasing.

Allison announces a new GitHub repository ruleset option that can block pull requests from merging when they introduce unresolved secret scanning alerts, adding an extra enforcement layer beyond push protection.

nschachter announces a Microsoft Fabric preview that adds table-level discovery to OneLake Catalog search, including Global Search and the OneLake Catalog Search API. The post explains how permission trimming works, what object-level security excludes, and which tenant setting admins should review before the late-September rollout.

Allison announces agentic autofix for GitHub Code Quality, letting teams select up to 25 findings and assign them to GitHub Copilot in one action. Copilot applies fixes on a branch, validates the changes, and opens a pull request for review, with usage governed by existing enterprise policy and AI credits.

Allison announces updates to GitHub Copilot for JetBrains, including enterprise-managed sandbox policies, cross-file cursor jumps for next edit suggestions, global project context in chat, and enterprise policy diagnostics. The release also adds a preview integration that connects Copilot CLI terminal sessions to IDE context and improves reliability across MCP and agent sessions.

Allison announces GitHub Enterprise Server (GHES) 3.22 general availability, highlighting updates for enterprise administration and collaboration, including Copilot CLI support for disconnected environments, enterprise teams, improvements to repository rulesets and required reviewers, and UI enhancements for issues and pull requests.

sbaynes announces codename MDASH, Microsoft’s multi-model agentic code-scanning system now deployed in Azure Government, aimed at finding and validating exploitable vulnerabilities across software supply chains with fewer false positives and more actionable results for security teams.

Rahul Bhandari and Tara Overfield recap the September 2026 servicing releases for .NET and .NET Framework, highlighting security and non-security fixes, the list of addressed CVEs, and where to find release notes, installers, container images, Linux packages, and known issues for supported versions.

kshatzkamer outlines a reference architecture for “orchestrated media intelligence”: an orchestration layer that connects trusted data, specialized AI models/agents, cloud infrastructure, and governance across end-to-end media workflows. The post uses Azure OpenAI, Azure AI Speech, and Azure AI Foundry examples to show how to keep humans accountable while scaling automation.

Matt Stratton talks with Naga Sujitha Vummaneni and Sundeep Bobba about reframing CI/CD pipelines as control systems, using feedback signals, constraints, and bounded automation to keep delivery stable—especially as AI-driven changes increase the pace and volume of deployments.

Thomas Maurer shares takeaways from a discussion at the HPE Customer Innovation Center on Azure Local and Microsoft’s Sovereign Private Cloud vision, focusing on how organizations can meet data residency, compliance, and operational control requirements while still using Azure-consistent capabilities in hybrid and edge environments.

davidwright walks through a practical, staged path for turning an Azure-hosted SaaS app into a transactable Azure Marketplace offer, using Git-Ape “skills” to generate version-controlled decision records for offer selection, multi-tenancy, landing zones, fulfillment/metering, security evidence, deployment blueprints, and Partner Center onboarding.

John Edward explains Microsoft Edge’s plan to retire Manifest V2 extensions for enterprises starting in early 2027, what the rollout timeline looks like, and what it means for extension developers and IT admins managing allow-lists and force-installed extensions.

This week in Security, the throughline is pushing enforcement into identity, networking, and auditable runtime controls as AI agents move from demos to deployable systems. GPT-6 Astra reached GA in Microsoft Foundry with enterprise deployment choices (throughput, region, residency) and governance hooks like Entra ID, RBAC, private networking, and monitoring that mirror how you secure other workloads. Guidance also sharpened around end-to-end agent hardening (egress containment, mediated tool use, Kubernetes policy layers, and OpenTelemetry-based evidence), while supply chain and CI/CD updates tightened provenance with key rotations, stronger OIDC-based publishing, and improved scanning and Actions permissions. Threat reports rounded out the week with practical detections for phishing evasion, helpdesk impersonation via Teams, and counterfeit installers, reinforcing the need for normalization, monitoring, and response-ready telemetry.

Cameron Tomisser shares a weekly Microsoft developer news roundup covering the Azure Developer CLI extension framework reaching GA, new CI/CD options to connect to Azure Cosmos DB without storing secrets, and progress on making agent security more production-ready.

John Savill runs through the Azure Weekly Update for 4th September 2026, covering a set of platform changes across compute, AKS, networking, monitoring, security, and Azure AI Foundry, with quick pointers to what’s new and where the updates land in the Azure stack.

Shayak Lahiri explains why Edge AI shifts security responsibility into customer-owned infrastructure, and outlines practical patterns for protecting model weights, credentials, and data. The post focuses on gating sensitive asset release using runtime attestation and artifact provenance, plus deterministic mediation to constrain what models can do.

Jesse Houwing shares a practical checklist for deciding whether a third-party GitHub Action is safe to run in your CI environment, focusing on maintenance signals, dependency hygiene, release integrity, and governance. He also explains why pinning what you run matters, and compares SHA pinning, immutable releases, and action lock files.

Jesse Houwing explains why GitHub Copilot cloud agent sessions can’t be spawned from GitHub Actions using GITHUB_TOKEN, and how GitHub’s accountability model (identity, billing, and auditability) shapes what “agentic workflows” can do today. He then lays out practical orchestration patterns that work, with concrete YAML examples.

devanshirastogi rounds up five recent Azure Firewall capabilities—some now generally available and others in public preview—covering explicit proxy support, IPv6 dual-stack filtering, HTTP header insertion, auto-learned SNAT routes via Azure Route Server, and higher-throughput IDPS with TLS inspection for Azure Firewall Premium.

rgarofalo walks through a hands-on build that locks down Azure AI Foundry both inbound (Private Endpoint) and outbound (agent egress via network injection), including the DNS zones you must create, how to prove public access is actually blocked, and how to troubleshoot opaque agent tool-call failures like 424 errors.

sbaynes announces GPT-6 Astra rolling out via the Microsoft Foundry Limited Access Program, focusing on agentic, multi-step work (planning, tool use, and computer use across apps) and the enterprise controls needed to run it safely in production, including identity, networking, governance, and monitoring.

Allison announces generally available updates to npm trusted publishing, including multiple OIDC configurations per package, staged approvals that wait for malware scanning to finish, and improved version history visibility for maintainers on npmjs.com.