Browse Security Community (123)

Madhura Amlekar explains how to assess Azure managed services before refreshing virtual machines. The guidance covers component-by-component migration, application compatibility, deployment and recovery checks, shared security responsibilities, and reservation commitments, while recognizing that some workloads still need VM-level control and that PaaS is not always cheaper.

Shivani_Tripathi explains how Private Network Gateway connects Azure Databricks serverless workloads to private resources through one managed, encrypted connection. The overview covers subnet delegation, workspace connectivity configuration, and routing options, while showing how existing Azure network controls continue to govern access and outbound traffic.

mukta introduces Enhanced Feature Flags (public preview) in Azure App Configuration, explaining how a dedicated resource model and API surface improve governance of feature rollouts. The post focuses on separating feature-flag permissions from general configuration, adding server-side validation, and keeping existing key-value feature flags supported.

poorvinarang explains how Azure Linux evolved from CBL-Mariner into Azure Linux 4.0, and what Microsoft changed to make it a supported, general-purpose Linux option for Azure VMs, VM Scale Sets, and container images, with a focus on upstream alignment, lifecycle predictability, and security servicing.

Ben Sickle outlines Microsoft’s announcements at NVIDIA GTC Berlin 2026 focused on running AI across Azure and customer-controlled environments, including Azure Local sovereign deployments, Foundry Local for on-prem model inference, confidential VMs, open-model endpoints for NVIDIA Nemotron via Fireworks AI on Azure, and GPU-accelerated analytics in Microsoft Fabric.

sonjagu rounds up the October updates for Azure SRE Agent, including new security and data residency guidance, enterprise deployment resources, GitHub Copilot Canvas collaboration, and new extension patterns like private Splunk MCP samples, Azure DevOps repo-backed plugin distribution, and ServiceNow response plans.

Stuart Russell outlines new and upcoming controls for Microsoft Sovereign Public Cloud and how they map to real Azure workload stages (data, indexing, inference, telemetry). The post covers Sovereign Control Panel, operator-access evidence features, key custody options with Managed HSM, confidential computing, and updated Sovereign Landing Zone implementations with Bicep and Terraform.

insagiv outlines how Foundry Local (GA on Azure Local) targets “sovereign AI” scenarios by running supported models in customer-controlled environments, including disconnected setups. The post covers local inference, model management, OpenAI-compatible APIs, retrieval with citations, early agent/connector capabilities via MCP, and how GitHub Enterprise Local supports SDLC sovereignty.

meenagowdar outlines new capabilities for Microsoft Sovereign Private Cloud built on Azure Local, including Foundry Local for running AI models on-premises, options for connected vs disconnected operations, confidential VMs for sensitive workloads, and GitHub Enterprise Local to keep repos and CI/CD inside a sovereign boundary.

sushil_jarwal announces GitHub Enterprise Local and explains how it brings GitHub Enterprise Server-style source control and workflows to customer-controlled Azure Local environments. The post highlights a guided Azure deployment flow using Workload Orchestration, storing deployment secrets in Azure Key Vault, and AI options ranging from GitHub Copilot (connected) to Foundry Local models (restricted/disconnected).

Bruno Borges outlines Microsoft’s Java support milestones through 2027 and what they mean for teams running Java on Azure. It highlights end-of-support timelines for Java versions on Azure App Service and Azure Functions, and points to tooling (Modernize CLI) to help plan and execute upgrades to newer Java releases.

Krishnaprasad Hande explains a reference architecture for running sensitive AI inference on shared Azure GPU capacity using Azure Confidential Computing, NVIDIA H100 confidential GPUs, and Protopia’s Stained Glass Transform, with attestation and key-release controls to reduce data exposure across the inference path.

EldertGrootenboer explains how to bridge an on-premises JMS broker (using IBM MQ as the example) to Azure Service Bus Premium with a standalone Apache Artemis JMS bridge, including connection factory setup, Entra ID authentication, and practical guidance for handling duplicates safely.

kinfey explains how to add per-turn model routing to GitHub Copilot CLI and the VS Code Copilot extension without replacing the native Copilot experience. The post introduces Microsoft-Decision-1 in Azure AI Foundry as a fast “decision model” for structured scoring, then shows how to apply policy, privacy boundaries, and model pinning across tool continuations.

Wiliam_Rosa explains how Azure Databricks cross-engine ABAC enforces Unity Catalog row filters, column masks, and ABAC policies for external Apache Spark reads by routing queries through a Databricks-managed serverless enforcement layer, including required metastore settings, grants, Spark configuration, known limitations, and cost tracking.

abhilashasr threat-models Azure MCP Server for AI-assisted incident response, focusing on how Entra ID, Azure RBAC, Key Vault, Policy, and monitoring controls prevent an assistant from turning diagnostics into unintended production changes. It also includes a read-only demo connecting GitHub Copilot in VS Code to Azure Monitor and Log Analytics.

dchelupati explains how to scale Azure SRE Agent from a single team to enterprise-wide use, focusing on access control, guardrails, auditing, multi-agent topologies, and “agent as code” practices for repeatable deployment and governance.

dchelupati shares a practical “start small” adoption guide for Azure SRE Agent, focused on picking a first operational use case, connecting only the required context (telemetry, repos, runbooks), and expanding into repeatable workflows with the right triggers and permissions.

Meagan McCrory explains that Extended Security Updates (ESU) for Windows Server 2012 and 2012 R2 ended on October 13, 2026, and outlines practical next steps to reduce security and compliance risk by upgrading, migrating to Azure, or modernizing workloads.

Bryankel summarizes six open-source hardware security innovations announced at the Open Compute Project Global Summit, covering workload-attached HSM design (Tessera), integrated TPM in the BMC, whole-system attestation (Composite EAT), hierarchical bare-metal management, streaming-boot recovery, and Caliptra 2.2 silicon hardening with post-quantum crypto support.

GisliGudmundsson shares a reference pattern for running Azure AI Foundry workloads inside a secure Azure landing zone, using private endpoints and private DNS zones, disabling local auth in favor of managed identity, and placing Azure API Management in front to enforce token limits and emit token usage metrics.

Rama Bhimanadhuni explains how Microsoft is working with the Open Compute Project (OCP) and major hardware vendors to standardize reliability and manageability for large, multi-vendor AI clusters, focusing on RAS signals, diagnostics, telemetry, and safer firmware update workflows to keep fleet capacity and availability high.

Brittany Pugh lays out a production-minded reference architecture for document-heavy intake on Azure, showing how to put AI behind a governed API gateway, process work asynchronously, and keep an end-to-end audit trail with a single correlation ID across API Management, Service Bus, Functions, and Event Grid.

santiagxf announces a public preview integration that connects Microsoft Agent 365 governance with Azure API Management runtime enforcement for MCP servers and tools, adding optional threat and data protection checks via Microsoft Defender and Microsoft Purview.

Alex-wdy explains how Azure CLI 2.91.0 adds preview support for native broker-based authentication on macOS, improving enterprise sign-in security and SSO. The post also covers the Homebrew Formula-to-Cask packaging change and provides step-by-step commands to enable, verify, and roll back the new sign-in flow.

tejabhutada explains practical ways to sync Jira Product Discovery ideas with Azure DevOps Epics, so approved roadmap items flow to engineering without manual re-entry and delivery status flows back to product. It breaks down what the Jira API can and can’t sync, plus the field, user, and state-mapping work that usually trips teams up.

gurjsing explains a common BYOK pitfall with Azure Key Vault and Azure Storage customer-managed keys: re-importing the same key material creates a new key version and won’t restore the original version identifier that dependent services may still require. The post lays out practical recovery, rotation, monitoring, and backup/restore guidance.

bobmital announces the general availability of Anyscale on Azure, a managed Ray runtime that runs on Azure Kubernetes Service in the customer’s subscription. The post explains the control-plane/data-plane split, Azure-native identity and governance integration, private connectivity options, and the kinds of AI/ML workloads teams can run end-to-end.

jalenmcg announces a public preview for onboarding Amazon EKS and Google GKE clusters into Azure Arc using the Azure Arc Multicloud Connector, focusing on automatic discovery, agent installation, and ongoing sync so multicloud Kubernetes can be governed and monitored from Azure.

Sreekanth Thirthala explains an upcoming Azure API Management networking change: new control-plane IPs are being added to the ApiManagement service tag, and customers using VNet internal/external on classic (v1) tiers need to update NSGs, UDRs, and firewall rules by November 30, 2026 to avoid losing management access.

Poornima99 announces the general availability of the GitOps with Argo CD extension for Azure Kubernetes Service (AKS), highlighting Microsoft-managed lifecycle, Entra ID SSO, workload identity federation for ACR/Azure DevOps, hardened Azure Linux images, and Azure Managed Prometheus metrics for observability.

Alex-wdy explains how the Azure AD Graph (graph.windows.net) retirement impacts older Azure CLI and Azure PowerShell versions, and what to check in developer machines, CI/CD agents, runbooks, and container images to avoid identity automation breaking during the phased shutdown after October 6, 2026.

shobhitgarg announces the public preview of Azure Backup v2 for Azure Database for PostgreSQL flexible servers and elastic clusters, outlining the move to snapshot-based physical backups, daily incremental scheduling, long-term retention options, and a new “Restore as Server” flow for faster, more consistent recovery.

Kerim Hanif announces the general availability of Azure Site Recovery for Azure Local, highlighting a new one-page Azure portal wizard for preparing infrastructure, plus key GA improvements like WDAC enforcement-mode support and built-in proxy configuration for regulated and locked-down network environments.

kinfey breaks down what changes when an AI agent can run tools and create side effects, then shows how to put real execution boundaries around those tools using OpenSandbox on AKS with Kata pod VMs, plus a comparison to Azure Container Apps Sandboxes and Dynamic Sessions.

Rebekah Midkiff lays out a reference architecture for governing AI agents across multiple Microsoft Entra tenants, combining Agent 365, Entra Agent ID, Microsoft Foundry, Copilot Studio, Purview, and an Azure API Management AI gateway to enforce identity, policy, tool access, and observability at runtime without collapsing tenant boundaries.

rickliev outlines Microsoft’s message for TM Forum Innovate Americas 2026: scaling agentic AI in telecom depends on trusted, governed data plus shared operational context. The post connects “agent-ready” data concepts (meaning, provenance, permissions) with Microsoft Fabric capabilities like OneLake, Fabric IQ, and Real-Time Intelligence.

shashankamalladi announces the general availability of Network Security Perimeter (NSP) metrics and explains how to use Azure Monitor to track allowed/denied access, spot unexpected traffic, and validate access rule changes with dashboards, workbooks, and metric alerts.

Mason Torres explains how Hotpatch works for Azure Arc-enabled Windows Server 2025 to reduce restart-driven maintenance windows while still keeping servers current with security updates. The post covers eligibility prerequisites (VBS/VSM, Secure Boot, Hyper-V Gen2), enrollment steps in the Azure portal, and how to manage updates after enrollment.

Jamesdld23 shows a practical pattern for sending email from an Azure Kubernetes Service (AKS) pod without storing any secrets, using Azure Workload Identity to get Microsoft Entra ID tokens and Exchange Online RBAC for Applications to scope Microsoft Graph Mail.Send down to a single authorized sender mailbox.