Browse Security Community (121)

tejabhutada explains practical ways to sync Jira Product Discovery ideas with Azure DevOps Epics, so approved roadmap items flow to engineering without manual re-entry and delivery status flows back to product. It breaks down what the Jira API can and can’t sync, plus the field, user, and state-mapping work that usually trips teams up.

gurjsing explains a common BYOK pitfall with Azure Key Vault and Azure Storage customer-managed keys: re-importing the same key material creates a new key version and won’t restore the original version identifier that dependent services may still require. The post lays out practical recovery, rotation, monitoring, and backup/restore guidance.

bobmital announces the general availability of Anyscale on Azure, a managed Ray runtime that runs on Azure Kubernetes Service in the customer’s subscription. The post explains the control-plane/data-plane split, Azure-native identity and governance integration, private connectivity options, and the kinds of AI/ML workloads teams can run end-to-end.

jalenmcg announces a public preview for onboarding Amazon EKS and Google GKE clusters into Azure Arc using the Azure Arc Multicloud Connector, focusing on automatic discovery, agent installation, and ongoing sync so multicloud Kubernetes can be governed and monitored from Azure.

Sreekanth Thirthala explains an upcoming Azure API Management networking change: new control-plane IPs are being added to the ApiManagement service tag, and customers using VNet internal/external on classic (v1) tiers need to update NSGs, UDRs, and firewall rules by November 30, 2026 to avoid losing management access.

Poornima99 announces the general availability of the GitOps with Argo CD extension for Azure Kubernetes Service (AKS), highlighting Microsoft-managed lifecycle, Entra ID SSO, workload identity federation for ACR/Azure DevOps, hardened Azure Linux images, and Azure Managed Prometheus metrics for observability.

Alex-wdy explains how the Azure AD Graph (graph.windows.net) retirement impacts older Azure CLI and Azure PowerShell versions, and what to check in developer machines, CI/CD agents, runbooks, and container images to avoid identity automation breaking during the phased shutdown after October 6, 2026.

shobhitgarg announces the public preview of Azure Backup v2 for Azure Database for PostgreSQL flexible servers and elastic clusters, outlining the move to snapshot-based physical backups, daily incremental scheduling, long-term retention options, and a new “Restore as Server” flow for faster, more consistent recovery.

Kerim Hanif announces the general availability of Azure Site Recovery for Azure Local, highlighting a new one-page Azure portal wizard for preparing infrastructure, plus key GA improvements like WDAC enforcement-mode support and built-in proxy configuration for regulated and locked-down network environments.

kinfey breaks down what changes when an AI agent can run tools and create side effects, then shows how to put real execution boundaries around those tools using OpenSandbox on AKS with Kata pod VMs, plus a comparison to Azure Container Apps Sandboxes and Dynamic Sessions.

Rebekah Midkiff lays out a reference architecture for governing AI agents across multiple Microsoft Entra tenants, combining Agent 365, Entra Agent ID, Microsoft Foundry, Copilot Studio, Purview, and an Azure API Management AI gateway to enforce identity, policy, tool access, and observability at runtime without collapsing tenant boundaries.

rickliev outlines Microsoft’s message for TM Forum Innovate Americas 2026: scaling agentic AI in telecom depends on trusted, governed data plus shared operational context. The post connects “agent-ready” data concepts (meaning, provenance, permissions) with Microsoft Fabric capabilities like OneLake, Fabric IQ, and Real-Time Intelligence.

shashankamalladi announces the general availability of Network Security Perimeter (NSP) metrics and explains how to use Azure Monitor to track allowed/denied access, spot unexpected traffic, and validate access rule changes with dashboards, workbooks, and metric alerts.

Mason Torres explains how Hotpatch works for Azure Arc-enabled Windows Server 2025 to reduce restart-driven maintenance windows while still keeping servers current with security updates. The post covers eligibility prerequisites (VBS/VSM, Secure Boot, Hyper-V Gen2), enrollment steps in the Azure portal, and how to manage updates after enrollment.

Jamesdld23 shows a practical pattern for sending email from an Azure Kubernetes Service (AKS) pod without storing any secrets, using Azure Workload Identity to get Microsoft Entra ID tokens and Exchange Online RBAC for Applications to scope Microsoft Graph Mail.Send down to a single authorized sender mailbox.

Matt Kazanowsky describes an Azure reference architecture that turns assembly videos into illustrated manufacturing work instructions using multimodal GenAI. It breaks down the end-to-end pipeline (ingestion, transcription, human review gates, step extraction, frame selection, and document generation) and calls out practical security controls for storage, identity, networking, and AI safety.

carlosbermudezlopez explains why Azure Storage accounts and containers can become undeletable after enabling immutability (WORM), including how locked vs unlocked policies, legal holds, blob versions, and snapshots affect deletion. It also covers how version retention changes trigger Lifecycle Management cleanup and what to check, in what order, to remove protected resources.

puneetguptams shares practical configuration guidance for Azure SRE Agent, based on patterns observed in production telemetry. The post focuses on connecting the right data sources, routing incidents to the right specialist via response plans, writing useful skills, deciding when to require approvals, and ensuring the agent has the permissions needed to complete the last step.

Lee Stott describes a developer demo that shows how to let an AI agent produce a decision brief while keeping real-world actions (like quarantining inventory) under deterministic, authenticated, auditable application control using MCP, Microsoft Foundry Hosted Agents, Entra auth, and Azure Blob Storage concurrency safeguards.

Jan-Kalis announces the general availability of Azure Container Apps Sandboxes and explains how they provide per-task, hardware-isolated microVMs for running untrusted code and agent workloads. The post covers network egress controls, VNet/private endpoint connectivity, snapshots and lifecycle policies, persistent volumes, and telemetry export options.

Lee Stott walks through Fibey Field Ops, a synthetic field-service assistant built with Microsoft Foundry Hosted Agents, MCP, and Azure Container Apps, focusing on the practical engineering work around tool contracts, identity boundaries, deployment sequencing, and debugging/observability rather than just model choice.

SaiVai shares registration details for an Azure retirements livestream focused on Network Security Group (NSG) flow logs in Azure Network Watcher, including the retirement tracking ID, key dates, and links to Service Health alerts and post-incident review resources.

Nate_Waters summarizes a wave of Azure Kubernetes Service (AKS) releases aimed at running AI workloads more safely and efficiently, covering isolation features (pod sandboxing, confidential GPU), agent-focused platform components (GitOps, burst scaling, GPU profiling), and capacity improvements for large-scale clusters and hybrid/edge deployments.

kinfey explains how Azure KARS (a Kubernetes reference stack) can run “coding-agent” CLIs as governed workloads, focusing on blast-radius control, credential isolation, and consistent policy enforcement across multiple agent runtimes like Copilot CLI, Claude Code, and Codex.

hailukassa introduces next-generation virtual nodes on Azure Container Instances (ACI) for Azure Kubernetes Service (AKS), showing how to add a serverless compute layer to a cluster for burst capacity and per-pod isolation. The post includes hands-on Helm and kubectl steps, plus how to enable confidential containers with hardware-backed attestation.

EldertGrootenboer explains how Azure API Management’s generally available send-service-bus-message policy lets an HTTP API enqueue work to Azure Service Bus, and which queue/topic patterns fit best for commands, routing, buffering, and independent scaling behind a governed API boundary.

piyush05 explains how to deploy Elastic’s serverless Elasticsearch Vector Database through Azure Native Integrations, then use it for hybrid (keyword + vector) semantic search and RAG. The post also covers Azure portal onboarding, permissions, Entra ID SSO, and Azure-connected billing for Elastic resources.

kinfey lays out a practical way to evaluate text-to-image models using the HEIM benchmark, focusing on repeatable testing across quality, instruction following, safety, bias, robustness, multilingual prompts, and production constraints like latency and cost.

javedeqbal explains how to extend an Azure Landing Zone for FinOps at scale by layering application-centric monitoring, consolidated alerting, automated remediation, and richer cost allocation on top of Azure-native governance, observability, identity, and cost-management services.

Prakhar Sharma outlines a practical pattern for treating Azure VM images like versioned build artifacts: bake once with Packer, publish to Azure Compute Gallery, validate the published version via an Azure DevOps pipeline, capture evidence, and promote only approved image versions.

Madhura Amlekar explains a common Azure API Management failure mode where custom-domain certificate renewals break when APIM sits behind Front Door, Traffic Manager, or Application Gateway. The post shows why validation passes at deployment but fails months later, and how to redesign the edge so renewals stay reliable.

abhilashasr proposes an Azure-native pattern for keeping Private Endpoint DNS records in centrally owned Private DNS zones when workloads span multiple Entra tenants. It combines Azure Policy (DeployIfNotExists) with Azure Lighthouse delegation, and outlines deployment phases, validation checks, and security guardrails.

tejabhutada lays out practical patterns for integrating ServiceNow with Azure DevOps, focusing on real-world sync scenarios like requests-to-user-stories, incident/bug routing across multiple orgs, and demand-to-feature delivery. The post highlights where native connectors work, where they break down, and what capabilities matter most for reliable, secure syncing.

Deepak_JV explains how Azure Confidential Clean Rooms supports privacy-preserving data collaboration for advertising use cases like audience matching and campaign measurement, using Spark SQL queries inside a Trusted Execution Environment (TEE) to help protect each participant’s raw data and provide verifiable governance.

SurbhiA walks through an image-based deployment approach for Azure Virtual Machine Scale Sets, showing how to build custom VM images, version them in Azure Compute Gallery, and roll out new versions via CI/CD with Azure DevOps pipelines, including rolling upgrades, rollback, and practical security considerations.

Wiliam_Rosa breaks down how Azure Databricks’ internal “AI SRE” agent speeds up incident investigation by gathering context automatically before engineers start debugging. The post focuses on an operational pattern: deterministic health checks and version-controlled runbooks first, then LLM-based synthesis—plus the guardrails needed to keep observability access safe.

Nivas Narayanasamy lays out a practical architecture for making private Azure VMware Solution workloads reachable by Azure AI Foundry agents without moving data. The post shows how to use MCP “bridge” servers on VNet-integrated Azure Container Apps, with ExpressRoute, private endpoints, Entra managed identity, and Key Vault-backed secrets to keep access private and read-only.

Mayuri Gupta announces the public preview of Azure Red Hat OpenShift hosted control planes, explaining how the control plane can run as a Microsoft-managed service while worker nodes stay in the customer subscription. The post covers operational benefits, Azure integrations (identity, monitoring, IaC), security controls, supported regions, and preview pricing.

Pamela_Fox shares the full set of MCP Live session recordings and resources, covering the Model Context Protocol’s latest spec updates, MCP server/client development in VS Code and GitHub Copilot, enterprise governance with Microsoft Foundry Toolboxes, and evolving MCP authentication patterns.

nzthiago explains the new GA support for site-scoped certificates and end-to-end TLS in Azure Functions Flex Consumption, including certificate sources (Key Vault, managed certs, uploads), how to expose certs to code on Linux workers, and how to implement inbound and outbound mutual TLS safely.