Weekly Security Roundup: Identity, DevSecOps gates, and agent controls

by TechHub

This week's Security roundup focuses on identity-first cloud defense and the controls that stop attacks at the first chokepoints: authentication, messaging, and the cloud control plane. Microsoft published a Cloud Web Applications Threat Matrix that turns ATT&CK techniques into concrete hardening priorities for App Service and serverless workloads, while new incident writeups show how passkey-themed lures, AI-assisted impersonation, and AiTM patterns translate into real Entra ID and M365 compromise paths. On the DevSecOps side, GitHub shipped enforceable guardrails (blocking PR merges with unresolved secrets, least-privilege cache access, and API-managed AI Scan rollout) alongside CodeQL updates, and the agent story matured with Citadel architecture guidance plus enterprise policies that constrain Copilot agent actions. Rounding it out are platform updates like user-bound delegation SAS in Azure Storage, managed-identity triggers for App Service integrations, network-aware migration planning, and the September .NET servicing releases that should land in your patch train.

This Week's Overview

Identity-first cloud defense: mapping threats and tightening access

Building on last week's focus on attackers targeting the control points between users, automation, and internal networks (including AI gateways and orchestration layers), Microsoft published a new Cloud Web Applications Threat Matrix that maps common cloud web app and serverless attack techniques to MITRE ATT&CK, with a strong focus on identity, CI/CD, runtime controls, and connected resources. For teams running Azure App Service, Functions, and similar platforms, the value is in turning a broad ATT&CK view into concrete priorities like locking down managed identities, deployment slots, and the paths between apps and their backing services.

On the identity side, two incident writeups reinforced how attackers are adapting social engineering to modern auth. One campaign used passkey-themed lures to drive Microsoft Entra ID compromise, then established persistence by adding MFA methods, used Microsoft Graph for recon, and pulled data at volume from SharePoint, OneDrive, and Exchange Online (with KQL hunting queries and remediation guidance included). Another analysis covered AI-assisted executive impersonation and invoice fraud in business email compromise (BEC), pairing technical mitigations (SPF/DKIM/DMARC hygiene) with Defender for Office 365, Defender XDR, and Security Copilot detections plus IOCs and ATT&CK mappings.

A separate threat intel roundup highlighted “AI-themed” phishing and malvertising, including adversary-in-the-middle (AiTM) and OAuth device code phishing patterns, and how Defender features like Safe Links, Safe Attachments, and attack disruption can contain multi-stage campaigns across email, identity, endpoints, and SaaS. The practical takeaway is that identity protection and message hygiene remain the first chokepoints, while disruption and cross-domain correlation matter once attackers pivot into cloud control planes.

DevSecOps guardrails: stopping secrets, hardening CI, and scaling scanning

This week brought several changes aimed at making security controls enforceable at the exact points where modern teams ship code: pull requests, CI caches, and automated fixes, extending last week's supply chain and repo moderation thread into more explicit, policy-backed gates. The common thread is moving from “advisory” security findings to policy-backed gates that can be rolled out programmatically.

Block merges when secrets are still exposed

Following last week's focus on scaling trust signals (including GitHub workflow improvements around advisories and moderation), GitHub added a repository ruleset (preview) that can block pull requests from merging if they introduce secret scanning alerts that are still unresolved. Unlike push protection, this gives you an explicit PR-stage enforcement layer, which is useful when secrets slip in through branches, rebases, generated files, or changes that bypass local checks.

The rule can be configured in the UI or managed via REST/GraphQL APIs, which matters for organizations standardizing controls across many repositories. Treat it like any other quality gate: decide what “resolved” means in your workflow (rotate credentials, remove from history if needed, add allowlists only when justified) and make the ruleset the final backstop.

Least-privilege for GitHub Actions caches with cache-mode (GA)

GitHub Actions cache-mode is now generally available, letting you restrict whether a workflow/job can restore caches, save caches, or both. This directly targets cache poisoning risk, especially in low-trust event contexts like pull_request_target, where an attacker might try to influence what later runs restore.

For practical use, apply the smallest set of permissions per job: allow restore-only for dependency steps that should not publish new caches, and reserve save permissions for trusted branches or hardened workflows. Pair this with branch protections and artifact provenance so cached dependencies do not become an unreviewed distribution channel inside your CI.

Programmatic rollout of AI Scan for pull requests (public preview)

GitHub code scanning added REST API endpoints (public preview) to enable and manage AI Scan for pull requests at the org and repo levels. This matters if you want consistent adoption without clicking through settings repo-by-repo, and it aligns with how most enterprises deploy security features (policy plus automation).

The preview is available on github.com for GitHub Advanced Security customers and does not support GitHub Enterprise Server. If you are a mixed GHES/GHEC shop, plan for feature parity gaps and document which repos get AI Scan enforcement versus standard CodeQL-only checks.

CodeQL 2.27.0 adds native Linux ARM64 support

CodeQL 2.27.0 now supports Linux ARM64 natively, which helps teams scanning on ARM-based build agents or running analysis alongside ARM CI fleets without cross-arch workarounds. The release also includes analysis improvements like expanded framework modeling for C# and Java/Kotlin, new/refined Rust queries, and updated GitHub Actions evaluation related to author-association checks.

If you maintain custom queries or depend on specific framework models (for example, ASP.NET Core MVC), review the release notes and re-baseline alert counts. Modeling changes can legitimately surface new findings, so treat the first run as both an upgrade and a tuning pass.

Securing AI and agent operations: architecture, governance, and permissions

As more teams operationalize AI agents, the security conversation is shifting from “which model” to “which controls surround it,” continuing last week's push for verification, governed tool access, tracing, and clear secret boundaries. This week's guidance centered on repeatable enterprise patterns for identity, observability, cost governance, and bounded automation, plus new policy tooling for Copilot agents.

Citadel architecture: bringing landing-zone governance to AI workloads

The Citadel reference architecture extends Azure landing zone patterns to enterprise AI by composing Microsoft Foundry with shared governance for access, identity, observability, and security. It explicitly frames agentic systems (including Foundry Agent Service and RAG pipelines) as workloads that need the same standardized controls you would demand of any tier-1 application.

For developers, the useful part is the “platform” mindset: Entra ID-backed identity, centralized logging/metrics via Azure Monitor, and consistent boundaries for data access and network paths. If you are already using Azure landing zones, Citadel reads like the missing blueprint for applying those controls to model endpoints, vector stores, and agent orchestration.

Agent governance that ties security to cost controls

A complementary Foundry post focused on agent optimization economics, but the mechanics map cleanly to security guardrails: project-level cost attribution, request-path token limits, and controls enforced through the Foundry Control Plane and Azure API Management AI Gateway. Token quotas and rate limits are not only spend controls, they are practical blast-radius limits when an agent loops, gets prompt-injected, or is abused through an exposed interface.

The post also emphasizes ROI tracking that connects agent costs to business outcomes, which can help security teams justify controls that add friction (approval workflows, stricter egress rules, tighter identity scopes). In practice, this is how governance becomes sustainable: guardrails that are measurable, attributable, and auditable.

Central policy controls for Copilot agent actions (GA)

Following last week's emphasis on governed tool access and “production packaging” for agents, GitHub shipped enterprise managed permissions for Copilot agent operations, giving admins centralized policies to allow, require approval for, or block specific agent actions like shell commands, file access, and network domain access. This is the control surface enterprises have been asking for as Copilot moves beyond suggestions into executing changes.

The key for teams is aligning these policies with existing privileged-operation boundaries. If a human would need elevated permissions to run a command, access a secrets file, or call an internal domain, require approval or block the agent by default and allow only the narrow set of actions needed for your workflows.

MCP auth: reducing client registration sprawl and planning for agent identity

Building on last week's warning that MCP and gateway surfaces need production-grade boundaries, two MCP (Model Context Protocol) auth talks dug into how authorization has evolved from an initial OAuth profile toward protected resource metadata and rethinking client registration. One practical pain point is Dynamic Client Registration creating a per-server client_id burden for MCP clients, and the proposed alternative is “Client ID Metadata Documents” where the client_id is a URL that servers fetch to obtain client metadata.

The forward-looking theme is enterprise-managed authorization and agent identity, which is where MCP needs to land if organizations want consistent controls across many tools and servers. If you are building MCP clients/servers now, design for change: keep auth concerns modular, be ready to adopt metadata-based client identity, and anticipate policy-managed enterprise approval flows.

Platform security updates in Azure: identity-bound tokens, managed identity triggers, and network-aware migration

Azure updates this week focused on reducing credential misuse and making security posture more explicit during deployment and migration, aligning with last week's theme that identity + network controls are the real choke points as automation expands. The theme across them is tightening identity bindings (who can use a token, which identity is calling your app) and improving security context in planning tools.

Azure Storage user delegation SAS can be bound to a specific Entra ID identity (GA)

Azure Storage now generally supports “user-bound user delegation SAS”, binding a user delegation SAS token to a specific Microsoft Entra ID identity. This helps address a long-standing weakness of SAS sharing: a token that leaks can be replayed by anyone who obtains it, even if it originated from an authenticated user flow.

The GA announcement includes cross-tenant configuration via allowCrossTenantDelegationSas, required RBAC roles, and steps to generate and share the token. If you rely on user delegation SAS for temporary access, this is a meaningful hardening step, especially for scenarios like support workflows and controlled data sharing where user attribution and non-transferability matter.

Azure Managed Connectors can trigger Azure App Service with managed identity (public preview)

Azure Managed Connectors now support Azure App Service as a trigger destination in public preview. The call pattern uses managed-identity tokens validated by App Service built-in authentication (Easy Auth), so you can avoid embedding secrets while still verifying the caller through Entra ID-backed identity.

The post links an end-to-end sample using ASP.NET Core, Bicep, and the Azure Developer CLI, which makes it easier to replicate securely across environments. For teams building event-driven integrations, this is a cleaner security baseline: identity-based auth, consistent provisioning, and less pressure to distribute shared keys across connector configurations.

Network-aware migration planning (public preview)

Azure Migrate Network Planning entered public preview to bring network intelligence into VMware migration planning. Beyond discovery and readiness, it adds Azure-native recommendations (for example, hub-and-spoke topology suggestions) with cost and security-rule context, including mapping considerations for NSGs and Azure Firewall.

For security and platform teams, this is useful because network design mistakes often become security debt that is expensive to unwind post-migration. If you treat the preview outputs as inputs to threat modeling and policy review (not just connectivity planning), you can standardize segmentation and firewalling before workloads land in Azure.

Patch, resilience, and disruption engineering

September 2026 .NET servicing releases (immediate action)

Microsoft shipped September 2026 servicing updates for .NET and .NET Framework, including security fixes with CVEs and updated packages for .NET 10, 9, and 8 (for example, .NET 10.0.12, .NET 9.0.20, and .NET 8.0.31). The post links release notes, downloads, container images, Linux install guidance, and known issues.

For most teams this is straightforward: update runtimes and SDKs, rebuild containers against the patched images, and validate CI/CD pipelines that pin to specific patch versions. If you run long-lived ASP.NET Core services, treat this as a standard monthly patch train item with rollout and monitoring, not an ad hoc update.

Resiliency tooling ties into cyber resilience

Azure's resiliency messaging is increasingly tied to security outcomes, especially around recovery and validation, and it pairs with last week's “patch window” framing by emphasizing how you limit blast radius when prevention fails. The latest Azure blog highlighted Azure Infrastructure Resiliency Manager, an Azure Copilot resiliency agent, per-disk resiliency for Azure Managed Disks (preview), and validation tooling like Azure Chaos Studio, plus Azure Backup features positioned for cyber resilience.

The developer implication is that resilience work is becoming more productized and testable: you can validate assumptions (failover, corruption scenarios, backup recovery) with tooling rather than runbooks. If you are tightening security posture, pair preventive controls with recovery validation and disruption testing so ransomware and destructive incidents have a measured, rehearsed response.

Other Security News

Supply chain and account recovery controls tightened on npm: after any recovery-code sign-in, npm now applies a 72-hour security hold that pauses publishing and other sensitive write actions (including access token creation) while still allowing sign-in and installs. For maintainers, this reduces the “immediate publish” window after account takeover, but it also means recovery events need to be planned around release schedules.

Microsoft announced codename MDASH, an agentic AI code-scanning capability deployed in Azure Government as a Microsoft Defender feature using models in Microsoft Foundry, aiming to find and validate exploitable vulnerabilities with fewer false positives. In parallel, GitHub Enterprise Server 3.22 reached GA with multiple security-relevant improvements, including better sorting for secret scanning push protection bypass and alert dismissal requests, plus broader ruleset and admin enhancements for regulated environments.

Several items broadened governance and compliance framing. Digital sovereignty guidance is now part of the Microsoft Cloud Adoption Framework, and a separate recap on Azure Local and the Microsoft Sovereign Private Cloud emphasized hybrid controls for data residency and customer-managed operations. If you are planning browser extension rollouts, note that Microsoft Edge plans to deprecate Manifest V2 extensions for enterprises starting in early 2027, pushing developers and IT admins toward Manifest V3 changes like service worker-based backgrounds and updated policy management.