Browse Security Blogs (31)

Thomas Maurer introduces the new digital sovereignty adoption guidance in the Microsoft Cloud Adoption Framework, explaining the sovereign cloud continuum and a practical three-phase path (planning, architecture/governance, and operations) for building and running controlled Azure workloads across public, private, and partner cloud models.

Matt Stratton talks with Naga Sujitha Vummaneni and Sundeep Bobba about reframing CI/CD pipelines as control systems, using feedback signals, constraints, and bounded automation to keep delivery stable—especially as AI-driven changes increase the pace and volume of deployments.

Thomas Maurer shares takeaways from a discussion at the HPE Customer Innovation Center on Azure Local and Microsoft’s Sovereign Private Cloud vision, focusing on how organizations can meet data residency, compliance, and operational control requirements while still using Azure-consistent capabilities in hybrid and edge environments.

John Edward explains Microsoft Edge’s plan to retire Manifest V2 extensions for enterprises starting in early 2027, what the rollout timeline looks like, and what it means for extension developers and IT admins managing allow-lists and force-installed extensions.

Jesse Houwing shares a practical checklist for deciding whether a third-party GitHub Action is safe to run in your CI environment, focusing on maintenance signals, dependency hygiene, release integrity, and governance. He also explains why pinning what you run matters, and compares SHA pinning, immutable releases, and action lock files.

Jesse Houwing explains why GitHub Copilot cloud agent sessions can’t be spawned from GitHub Actions using GITHUB_TOKEN, and how GitHub’s accountability model (identity, billing, and auditability) shapes what “agentic workflows” can do today. He then lays out practical orchestration patterns that work, with concrete YAML examples.

John Edward covers a Copilot Studio authentication update that adds Microsoft Entra ID-based identity for both delegated user access and service-to-service (S2S) scenarios, aimed at making enterprise agent deployments easier to secure and integrate with existing applications.

John Edward summarizes Microsoft’s warning that firewall, proxy, and TLS inspection setups can break Windows Update connectivity, leaving devices without security patches. The post explains the certificate trust model behind Windows Update, why wildcard FQDN allowlists matter, and how admins can use PowerShell and audit logs to confirm the issue before changing network rules.

John Edward lays out a practical checklist for taking an AI agent from demo to production using Microsoft Copilot and Azure AI Foundry, focusing on architecture choices, grounding with enterprise data, controlled tool permissions, evaluation, monitoring, and cost/latency controls.

John Naguib lays out a practical architecture for building self-improving AI agents on Azure, focusing on controlled feedback loops (evaluate, learn, test, approve) rather than uncontrolled self-modification. The guide covers agent runtime, tool calling, RAG, memory/experience stores, evaluation, observability, and governance for production use.

Matt Stratton talks with Doug Pagnutti about “industrial DevOps”: the long-running friction between corporate IT and plant-floor OT in manufacturing, why incentives and ticket-driven workflows create risky workarounds, and how security and data-sharing requirements are forcing the two worlds to converge.

John Edward explains Microsoft’s required Microsoft Defender for Endpoint update on Android ahead of infrastructure changes, including the minimum supported app version and the rollout timeline. The post focuses on what IT admins should do to avoid disruptions to mobile threat protection across managed and user-updated devices.

DevClass reports on ChainDrop, a new Shai-Hulud npm worm variant that compromises packages via tarballs and can persist through repository configuration files, enabling credential theft and further propagation. The article explains how the attack spreads through npm, GitHub, and developer tools like VS Code, and outlines practical checks and mitigations.

John Edward breaks down Microsoft’s August 2026 Windows security update, focusing on the phased Secure Boot certificate rollout, servicing stack improvements, and what admins and users should expect during installation (including a possible extra restart) across Windows 11, Windows 10, and Windows Server.

John Edward covers a Microsoft Defender update that surfaces AI-generated Microsoft Purview Insider Risk Management triage summaries directly in the Defender alert queue, helping SOC analysts and insider risk investigators triage alerts faster while keeping the full investigation workflow in Purview.

Andrew Lock explains the new CSRF protection in ASP.NET Core (.NET 11 preview 6) that uses Fetch Metadata HTTP headers instead of synchronizer tokens, including how the middleware decides to allow or deny requests and what changes (if any) app authors need to make.

John Edward explains Microsoft’s retirement of support for the Microsoft Entra SSO plug-ins used with self-hosted Atlassian Jira and Confluence (Server/Data Center), what “unsupported” means in practice, and the security and operational risks organizations should plan for after July 31, 2026.

John Edward breaks down what GitHub Copilot does (and doesn’t) send to the service, how training and retention settings vary by subscription, and the practical security risks teams should plan for when using AI-assisted coding in real projects.

Andrew Lock explains the browser Fetch Metadata request headers (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User), what their values mean, and how servers can use them to spot suspicious cross-origin requests and add another layer of CSRF defense alongside tokens and SameSite cookies.

John Edward outlines practical Azure architecture best practices for enterprise applications, covering the Azure Well-Architected Framework, scalability and high availability patterns, security with Zero Trust, observability, infrastructure as code, CI/CD, cost controls, networking, disaster recovery, and governance.

John Edward explains why AI agents that look great in demos often break down in production, and what teams need to engineer around the model to make agents reliable at scale.

Rob Bos shares a curated set of GitHub governance references he regularly sends to teams, covering enterprise platform baselines, GitHub Actions supply-chain controls, GitHub Advanced Security rollout and triage practices, and GitHub Copilot governance topics like premium requests, extension governance, and MCP-related security notes.

John Edward explains how Azure’s “Agentic Agents” can support resilient cloud operations across migration planning, observability, and continuous optimization. The article focuses on turning telemetry into actionable guidance, reducing alert fatigue, improving root-cause analysis, and driving cost, performance, security, and sustainability improvements in Azure environments.

John Edward outlines an end-to-end approach for building a ServiceNow-focused AI assistant in Microsoft Copilot Studio, aimed at ticket auditing, SLA risk monitoring, and engineer performance reporting. The guide covers a layered architecture, ServiceNow REST API integration via Power Platform custom connectors, and practical security considerations for enterprise deployment.

Hidde de Smet explains how MCP’s Enterprise-Managed Authorization changes MCP authentication from per-server OAuth consent to policy-driven sign-in via an identity provider, with VS Code 1.123 preview support for Entra ID, Okta, and Auth0 and governance controls that pair with GitHub Copilot’s MCP registry policies.

Thomas Maurer explains what Azure Local Small Form Factor (SFF) is and why it matters for edge scenarios, then outlines an end-to-end deployment flow: provisioning a device as an Azure resource, installing the Azure Local OS, registering it with Azure Arc, and running container workloads with Docker and K3s.

DevClass reports on Vercel’s Ship event announcements, focusing on the new open source eve agent framework and enterprise controls like Passport for bringing AI-built apps and agents under centralized identity and policy, including OpenID Connect support for providers such as Okta and Microsoft Entra ID.

DevClass reports on upcoming npm 12 default changes that stop install-time scripts from running automatically, aiming to reduce a major supply-chain attack surface on developer machines and CI runners. The piece explains the new flags, breaking-change impact, and how teams can prepare using npm 11.x settings.

DevClass reports on Checkmarx survey findings that many developers believe AI-generated code contains more vulnerabilities, yet some still ship it to production. The piece connects AI-assisted development, open source supply-chain risk, and security process gaps to higher breach frequency.

Thomas Maurer explains Azure Local Simplified Machine Provisioning, a new workflow for provisioning physical Azure Local nodes with minimal on-site work while keeping configuration and control centralized in Azure.

Hidde de Smet shows how to add fast local guardrails for Azure Terraform by running fmt, validate, tflint, Trivy, and terraform-docs on every git commit. The post includes a working pre-commit config, Azure-specific lint rules, and an MCP-based workflow to keep generated HCL current and policy-aligned.