Browse Security Community (100)

ellievail announces general availability of user-bound user delegation SAS for Azure Storage, which restricts a user delegation SAS token so it can only be used by a specific Microsoft Entra ID identity. The post explains how it works with RBAC, cross-tenant scenarios, and how to generate and share tokens safely.

Sudha Mahajan explains how Azure Migrate Network Planning adds network-aware discovery and assessment to VMware lift-and-shift migrations, helping teams capture dependencies, translate source constructs into Azure networking recommendations, surface readiness issues, and include network costs and security intent in the migration business case.

kshatzkamer outlines a reference architecture for “orchestrated media intelligence”: an orchestration layer that connects trusted data, specialized AI models/agents, cloud infrastructure, and governance across end-to-end media workflows. The post uses Azure OpenAI, Azure AI Speech, and Azure AI Foundry examples to show how to keep humans accountable while scaling automation.

devanshirastogi rounds up five recent Azure Firewall capabilities—some now generally available and others in public preview—covering explicit proxy support, IPv6 dual-stack filtering, HTTP header insertion, auto-learned SNAT routes via Azure Route Server, and higher-throughput IDPS with TLS inspection for Azure Firewall Premium.

rgarofalo walks through a hands-on build that locks down Azure AI Foundry both inbound (Private Endpoint) and outbound (agent egress via network injection), including the DNS zones you must create, how to prove public access is actually blocked, and how to troubleshoot opaque agent tool-call failures like 424 errors.

pranabpaul continues the 3IQ Retail Assistant demo by wiring unstructured PDF content into an Azure AI Foundry agent using Azure Blob Storage and Azure AI Search, including the RBAC permissions needed for managed identities and the networking trade-offs involved when publishing the agent to Microsoft 365 Copilot.

Mohammed Barqawi introduces Logic App Storage Inspector, a read-only Kudu site extension that helps troubleshoot Azure Logic Apps Standard by inspecting the underlying storage for workflow history, versions, and queue health, with guidance on installation, configuration settings, and managed identity permissions.

kinfey explains why “AI agent infrastructure” needs stronger security boundaries than traditional model hosting, using kars (an open-source Agent Reference Stack for Kubernetes) to show how to isolate agent runtimes, broker identity, govern tools/MCP, control egress, enforce token budgets, and produce auditable evidence for incident response.

devanshirastogi announces the general availability of explicit proxy in Azure Firewall, explaining how to steer selected HTTP/HTTPS traffic through a single proxy port for centralized inspection. The post highlights managed-identity access to PAC files in Azure Blob Storage, a streamlined portal workflow, and hybrid scenarios like securing Azure Arc connectivity over ExpressRoute or VPN.

ChethanRaj outlines a practical way to design Azure access using RBAC and Managed Identities, with an emphasis on least-privilege permissions across people, applications, and deployment pipelines. The post highlights common design mistakes and how to avoid over-scoping access (for example, granting Contributor when only Key Vault secret read is needed).

ChethanRaj outlines the key trade-offs when designing Dev, UAT, Staging, and Production environment boundaries in Azure, focusing on when to separate by resource group versus subscription, how to place shared services, and how operational and security boundaries should drive the overall structure.

ChethanRaj outlines practical considerations for structuring Dev, UAT, Staging, and Production environments in Azure, focusing on when to separate by resource group vs subscription, where to place shared services, and how operational and security boundaries should drive the design.

Alex-wdy explains an upcoming Azure Key Vault control plane API retirement and the required tooling upgrades to avoid breaking vault management operations. The post lists minimum Azure CLI and Az PowerShell versions, how to check what you have installed, and the exact upgrade commands to run before the February 27, 2027 deadline.

gurjsing shows how to turn Microsoft’s published compliance scope (using Germany’s C5 as the example) into enforceable Azure controls by extracting the certified-service list from the Service Trust Portal, mapping it to ARM resource types, and deploying a deny/audit Azure Policy with a reviewable, automated workflow.

Nicolas Mondada announces the GA release of Certificate Management for Azure Arc-enabled Kubernetes, a Microsoft-managed extension that automates TLS certificate issuance/renewal and trust bundle distribution across edge fleets, including support for disconnected operation, broad distro validation, and ARM64 edge hardware.

anishta announces GA support for sending Azure Service Bus messages directly from Azure API Management using the send-service-bus-message policy, turning APIM into a governed HTTP front door for asynchronous workloads. The post explains message property controls, failure-handling options, and securing access with Microsoft Entra managed identity and Azure RBAC.

Sudha Mahajan introduces Azure Multicloud Interconnect, a jointly engineered Microsoft and AWS managed service for private, high-throughput connectivity between Azure and AWS, aimed at reducing the operational complexity of stitching together ExpressRoute, Direct Connect, routers, BGP peering, and encryption.

AbhinavPremsekhar explains how to run authenticated browser workflows for Azure AI Foundry agents without exposing credentials to the model, using Browser Automation Tool (BAT) with Playwright Workspaces and Azure Key Vault. The post focuses on secret storage, RBAC access, just-in-time retrieval, and practical security guardrails.

tejabhutada explains how to sync multiple Azure DevOps organizations into a single ServiceNow instance without forcing teams onto a shared Azure DevOps process, outlining common multi-org scenarios, what to evaluate (filters, mappings, conflicts, security), and practical implementation options from webhooks to Azure-based middleware.

Cary Chai announces general availability of VNet integration for Azure SRE Agent and explains how it routes outbound agent traffic through your virtual network so you can reach private endpoints while still enforcing existing routes, NSG rules, firewall policies, private DNS, and network logging.

yashnisar introduces Live Reports in Azure SRE Agent (public preview), a way for ops teams to describe an operational dashboard in chat and have the agent generate a deterministic page that refreshes live data on each open. The post explains token-cost behavior, connector/tool-call mechanics, and the guardrails used to keep report execution constrained.

sanchitmehta (with co-author visagarwal) explains how Azure SRE Agent was redesigned to make autonomous operations safer by moving enforcement outside the agent’s reach—using microVM sandboxing, secretless authentication, output scrubbing, and risk-based approval so the environment, not the prompt, becomes the policy boundary.

kevinguo announces Azure Web PubSub chat (public preview), a managed chat capability on top of Azure Web PubSub that adds chat-native concepts like rooms, members, roles, ordered messages, and persistent history, with a JavaScript client SDK and a REST API for server-side control.

WSilveira explains how the MCP Connectors canvas extension for the GitHub Copilot app lets agents use hosted MCP servers from Azure Connector Namespace without manually wiring endpoints, headers, or local proxies. It also covers how the user-scoped MCP config works across the Copilot app and Copilot CLI, plus key security details.

Pamela Fox shows how to build a browser-using QA agent by combining Pydantic AI with Playwright, backed by Microsoft Foundry models. The post covers keyless Entra authentication, safe browsing constraints, and OpenTelemetry tracing with optional export to Azure Application Insights.

Rajasekharvemula outlines a practical approach to deploying an Azure Landing Zone with a repeatable pipeline using Azure DevOps and Terraform, covering Git workflow, CI validation, environment promotion, governance via Azure Policy, identity/RBAC automation, monitoring setup, and Terraform state management in Azure Storage.

lily-ma explains how to extend Azure SRE Agent with MCP servers by hosting them in Azure Connector Namespace, then wiring them into the agent’s connector experience. The post includes an end-to-end example using Azure Developer CLI (azd), managed identity auth, and access policies to connect a hosted SQL MCP server.

Teodora Sutilovic outlines what’s new in the small form factor infrastructure preview (version 2607) for Azure Local, including multi-NIC and extra disk support modeled in Azure Resource Manager, Just-in-Time access via Entra PIM with SSH certificates, and safer OS updates using an A/B image-swap rollback model.

samimodak announces the public preview of Azure DNS Traffic Manager linked records, which let Azure DNS link record sets directly to Azure Traffic Manager profiles. The post explains how this removes the trafficmanager.net CNAME hop, enables zone-apex load balancing, and improves DNSSEC compatibility and operational safety.

Mason_Torres explains how to onboard large Windows and Linux server estates to Azure Arc using non-interactive authentication and automation, focusing on two scalable approaches: Ansible for Linux fleets and Group Policy for domain-joined Windows Server environments.

Gaurav Seth announces GA for Managed Instance on Azure App Service, aimed at lifting and modernizing legacy .NET Framework apps with minimal or no code changes. The post highlights new GA capabilities like Premium v4 support, zone redundancy, deeper observability, managed identity defaults, governance/security coverage, and IaC options.

aparnabadireddigari explains what it takes to move Actions Runner Controller (ARC) on Azure Kubernetes Service (AKS) from a working demo to a production-ready GitHub Actions runner platform, focusing on identity scope, network egress/DNS, workload isolation, runner image lifecycle, observability, and operational ownership.

Abhinav Premsekhar explains why cloud-hosted browsers are becoming a core platform capability for running browser automation and AI agents at scale, with a focus on the operational requirements enterprises hit in production: isolation, governance, observability, reproducibility, and geographic execution.

Harel Broitman explains how to connect Azure Monitor issues with ServiceNow ITOM so incidents and alerts stay linked and status changes sync both ways during an active response, reducing manual copy/paste and keeping technical investigation context aligned with ITSM workflows.

ChethanRaj asks how to structure Azure Resource Groups for an enterprise integration platform, focusing on how grouping choices affect ownership, lifecycle management, RBAC boundaries, and day-to-day operations across shared infrastructure and workload-specific components.

Pamela Fox walks through practical MCP server designs for giving coding agents safe access to a PostgreSQL database, from free-form SQL to fully templated tools. She highlights where flexibility creates risk, and shows concrete guardrails like schema discovery patterns, read-only enforcement, and confirmation flows for destructive actions.

daisami shows how to combine Microsoft Agent Framework Harness with the Agent Governance Toolkit (AGT) to enforce tool-call policy for a file-access agent. The walkthrough uses a YAML allow/deny policy, function-call middleware, and audit events so risky operations (write/delete/replace) are blocked at execution time, not just in prompts.

Jordan Selig explains what the dedicated Azure API Management AI Gateway tier changes (and doesn’t change) for AI agents hosted on Azure App Service, using a runnable Python/FastAPI sample that forces all model and MCP tool traffic through the gateway with policy, telemetry, and secret-handling patterns.

Jan Kalis (co-written with Nikoloz Buligini) introduces Azure Container Apps Sandboxes (Preview) as a hardware-isolated microVM environment for running AI agent workflows safely, with practical controls like snapshots, restricted egress, managed identities, and VNet integration, plus a real production example from Templafy.

Ariel Netz announces new security monitoring integrations that let Azure Local forward security signals into IBM QRadar and Splunk, aimed at regulated, sovereign, and disconnected environments. The post highlights built-in Azure Local security controls and points to guidance for audit log forwarding and security features.