Browse Security Blogs (31)

Emanuele Bartolesi shares a practical fix for high CPU/disk usage on Windows 11 when running Claude, Codex, and GitHub Copilot tooling: adding targeted Microsoft Defender Antivirus folder exclusions. The post also calls out the security tradeoff and walks through the exact Windows Security steps to apply exclusions safely.

John Edward covers Microsoft’s new self-service onboarding flow for publishing new applications to the Microsoft Entra App Gallery, including built-in validation for SSO and provisioning integrations, submission tracking, and the rollout timeline from public preview to general availability in late 2026.

John Edward explains Microsoft’s 2026 retirement of SharePoint Online’s one-time passcode (SPO OTP) flow and the shift to Microsoft Entra B2B guest accounts for external sharing in SharePoint Online and OneDrive, including what breaks, what stays, and what admins should do before the October–November rollout completes.

John Edward covers Microsoft and AWS’s Azure Multicloud Interconnect for AWS announcement, focusing on what it changes for private, high-bandwidth connectivity between the two clouds and why it matters for teams running cross-cloud, data-heavy workloads.

Thomas Maurer argues that Azure Local should be evaluated as the infrastructure foundation of Microsoft Sovereign Private Cloud, not just as a hypervisor replacement. He breaks down connected vs disconnected operations, Azure Arc control-plane options, and the platform capabilities (AKS, data services, Foundry Local, GitHub Enterprise Local) that shape sovereignty and resilience.

Andrew Lock walks through the new experimental Device Bound Session Credentials (DBSC) support in ASP.NET Core for .NET 11, showing how to harden cookie authentication (including ASP.NET Core Identity) against session hijacking and what the registration/refresh protocol looks like in practice.

Hidde de Smet lays out a practical way to judge whether a repo is actually ready for AI coding agents, using GitHub Copilot cloud agent as the concrete example. It focuses on repeatable setup, shared commands, focused tests, CI enforcement, and security boundaries so agent sessions aren’t wasted on missing prerequisites.

Andrew Lock introduces Device Bound Session Credentials (DBSC), a browser/server protocol that makes stolen authentication cookies much harder to reuse on another machine. He explains the threat model (cookie theft and session hijacking), how DBSC uses TPM-backed keys and signed challenges, and what endpoints a server needs to add to support it.

Rick Strahl explains why files under ASP.NET Core’s wwwroot are public by default, and how to protect dynamically generated “static” files (like admin logs) so they still respect authentication and authorization rules.

Thomas Maurer introduces the new digital sovereignty adoption guidance in the Microsoft Cloud Adoption Framework, explaining the sovereign cloud continuum and a practical three-phase path (planning, architecture/governance, and operations) for building and running controlled Azure workloads across public, private, and partner cloud models.

Matt Stratton talks with Naga Sujitha Vummaneni and Sundeep Bobba about reframing CI/CD pipelines as control systems, using feedback signals, constraints, and bounded automation to keep delivery stable—especially as AI-driven changes increase the pace and volume of deployments.

Thomas Maurer shares takeaways from a discussion at the HPE Customer Innovation Center on Azure Local and Microsoft’s Sovereign Private Cloud vision, focusing on how organizations can meet data residency, compliance, and operational control requirements while still using Azure-consistent capabilities in hybrid and edge environments.

John Edward explains Microsoft Edge’s plan to retire Manifest V2 extensions for enterprises starting in early 2027, what the rollout timeline looks like, and what it means for extension developers and IT admins managing allow-lists and force-installed extensions.

Jesse Houwing shares a practical checklist for deciding whether a third-party GitHub Action is safe to run in your CI environment, focusing on maintenance signals, dependency hygiene, release integrity, and governance. He also explains why pinning what you run matters, and compares SHA pinning, immutable releases, and action lock files.

Jesse Houwing explains why GitHub Copilot cloud agent sessions can’t be spawned from GitHub Actions using GITHUB_TOKEN, and how GitHub’s accountability model (identity, billing, and auditability) shapes what “agentic workflows” can do today. He then lays out practical orchestration patterns that work, with concrete YAML examples.

John Edward covers a Copilot Studio authentication update that adds Microsoft Entra ID-based identity for both delegated user access and service-to-service (S2S) scenarios, aimed at making enterprise agent deployments easier to secure and integrate with existing applications.

John Edward summarizes Microsoft’s warning that firewall, proxy, and TLS inspection setups can break Windows Update connectivity, leaving devices without security patches. The post explains the certificate trust model behind Windows Update, why wildcard FQDN allowlists matter, and how admins can use PowerShell and audit logs to confirm the issue before changing network rules.

John Edward lays out a practical checklist for taking an AI agent from demo to production using Microsoft Copilot and Azure AI Foundry, focusing on architecture choices, grounding with enterprise data, controlled tool permissions, evaluation, monitoring, and cost/latency controls.

John Naguib lays out a practical architecture for building self-improving AI agents on Azure, focusing on controlled feedback loops (evaluate, learn, test, approve) rather than uncontrolled self-modification. The guide covers agent runtime, tool calling, RAG, memory/experience stores, evaluation, observability, and governance for production use.

Matt Stratton talks with Doug Pagnutti about “industrial DevOps”: the long-running friction between corporate IT and plant-floor OT in manufacturing, why incentives and ticket-driven workflows create risky workarounds, and how security and data-sharing requirements are forcing the two worlds to converge.

John Edward explains Microsoft’s required Microsoft Defender for Endpoint update on Android ahead of infrastructure changes, including the minimum supported app version and the rollout timeline. The post focuses on what IT admins should do to avoid disruptions to mobile threat protection across managed and user-updated devices.

DevClass reports on ChainDrop, a new Shai-Hulud npm worm variant that compromises packages via tarballs and can persist through repository configuration files, enabling credential theft and further propagation. The article explains how the attack spreads through npm, GitHub, and developer tools like VS Code, and outlines practical checks and mitigations.

John Edward breaks down Microsoft’s August 2026 Windows security update, focusing on the phased Secure Boot certificate rollout, servicing stack improvements, and what admins and users should expect during installation (including a possible extra restart) across Windows 11, Windows 10, and Windows Server.

John Edward covers a Microsoft Defender update that surfaces AI-generated Microsoft Purview Insider Risk Management triage summaries directly in the Defender alert queue, helping SOC analysts and insider risk investigators triage alerts faster while keeping the full investigation workflow in Purview.

Andrew Lock explains the new CSRF protection in ASP.NET Core (.NET 11 preview 6) that uses Fetch Metadata HTTP headers instead of synchronizer tokens, including how the middleware decides to allow or deny requests and what changes (if any) app authors need to make.

John Edward explains Microsoft’s retirement of support for the Microsoft Entra SSO plug-ins used with self-hosted Atlassian Jira and Confluence (Server/Data Center), what “unsupported” means in practice, and the security and operational risks organizations should plan for after July 31, 2026.

John Edward breaks down what GitHub Copilot does (and doesn’t) send to the service, how training and retention settings vary by subscription, and the practical security risks teams should plan for when using AI-assisted coding in real projects.

Andrew Lock explains the browser Fetch Metadata request headers (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User), what their values mean, and how servers can use them to spot suspicious cross-origin requests and add another layer of CSRF defense alongside tokens and SameSite cookies.

John Edward outlines practical Azure architecture best practices for enterprise applications, covering the Azure Well-Architected Framework, scalability and high availability patterns, security with Zero Trust, observability, infrastructure as code, CI/CD, cost controls, networking, disaster recovery, and governance.

John Edward explains why AI agents that look great in demos often break down in production, and what teams need to engineer around the model to make agents reliable at scale.

Rob Bos shares a curated set of GitHub governance references he regularly sends to teams, covering enterprise platform baselines, GitHub Actions supply-chain controls, GitHub Advanced Security rollout and triage practices, and GitHub Copilot governance topics like premium requests, extension governance, and MCP-related security notes.