Azure Weekly

Issue 569

28th June 2026

Quite a busy edition this week, with a good mixture of Microsoft and Community content. Highlights include:

  • Introducing Cohere Command A+ in Foundry by Rashaud Savage - Command A+, Cohere’s 218B-parameter mixture-of-experts model now available in Microsoft Foundry, enables enterprise agents to reason across 48 languages, process multimodal inputs like images and tables, and orchestrate complex multi-step workflows with sub-second latency.
  • Azure Copilot Observability Agent is generally available, with autonomous operations in preview by Efrat Nauerman - The Azure Copilot Observability Agent, now generally available with autonomous operations in preview, transforms alert noise into investigated issues by integrating AI reasoning across telemetry, resource context, and custom instructions to help teams quickly identify changes, and correlations.
  • Inside Llama 3.1 405B MLPerf Training on Azure: System-Level Insights at 8K+ GPU Scale by shantanupatankar, Azin Heidarshenas - Scaling Llama 3.1 405B to 8,192 GPUs on Azure's Fairwater infrastructure reveals that feed-forward network kernels dominate compute time, while topology-aware mapping is crucial for achieving ultra-high scale efficiency.
  • Building Practical Rowhammer Protection into Azure Cobalt 200 by Stefan Saroiu, Alec Wolman, Anant Deval, Sashi Majety - Azure Cobalt 200 incorporates advanced Rowhammer protection directly into its memory controller, using a hybrid design that balances performance and security without adding measurable overhead, as detailed in a recent research paper presented at ISCA 2026.
  • Guarding AI memory by Natalie Isak, Sarah Cooley - Guarding AI memory involves protecting both personalization and agentic coherence while addressing unique attack vectors like delayed tool execution through adversarial memory poisoning, with Microsoft 365 implementing defense-in-depth measures across creation, storage, retrieval, model…
  • MCP Server Authorization with Azure API Management: From Simple to Advanced by vzisiadis - Azure API Management integrates with the Model Context Protocol (MCP) to provide robust authorization options-from simple token validation to interactive OAuth sign-in-enabling fine-grained control over who can access MCP servers and what actions they may perform.
  • Only 8.5% of MCP Servers Use OAuth — Here's How to Host One Securely on App Service by Jordan Selig - Deploying an MCP server on Azure App Service with built-in Easy Auth and Entra ID integration secures it against common vulnerabilities like CVE-2025-6514 and CVE-2025-49596, ensuring authenticated access to tools while protecting secrets and preventing unauthorized code execution.
  • The end of a Azure Data Platforms era, and the future with Databricks- and Fabric-centric architectures by Adam Marczak - Azure Data Platforms will transition toward Databricks, and Fabric-centric architectures, prompting organizations to reassess their data strategies and infrastructure investments.

Finally, we are launching our new Fabric Weekly newsletter this week. Sign up if you'd like to receive it!

🤖 AI

🔎 Analytics

🖥️ Compute

🚢 Containers

  • Connecting Azure Kubernetes Clusters to Tailscale Networks by Colby T. Ford, Ph.D. · 6 min read This article demonstrates how to securely connect an Azure Kubernetes Service cluster to a Tailscale private network using a proxy, enabling easy and secure access from any device within the Tailnet without complex VPN setups.
  • Build Agent Architecture using AI Landing Zones by Zachary Cavanell · 11 min read The AI Landing Zones framework from Microsoft enables secure governance, unified control, and flexible runtime options for building and scaling enterprise AI agents across the Azure and 365 platforms.
  • IPv6 Dual-Stack Endpoints for Azure Container Registry (Public Preview) by Johnson Shi · 3 min read Azure Container Registry now offers a public preview of IPv6 dual-stack endpoints, allowing registries to serve both IPv4 and IPv6 clients simultaneously while requiring Premium SKU and dedicated data endpoints for full functionality.
  • How Many Copies of Each Layer Does Your Container Registry Actually Need? by payalmahesh, Vicky Lin, Jeanine Burke, Johnson Shi · 8 min read Azure Container Registry’s performance curve shows that adding container image layer copies boosts pull speeds up to a moderate point, after which extra copies stop helping and can even slow things down due to storage bottlenecks.

🗄️ Databases

  • Take control of your PostgreSQL maintenance by Jeremy Asomaning · 6 min read Azure Database for PostgreSQL flexible server now offers self-service controls to view, reschedule, and apply upcoming maintenance directly from the Azure portal, reducing disruption during critical business periods.
  • Generic Best Practices for HikariCP with Azure Database for PostgreSQL by Mohamed Baioumy MSFT · 4 min read Configuring HikariCP for Azure Database for PostgreSQL involves setting maxLifetime to 30 minutes, maintaining minimumIdle slightly below maximumPoolSize (e.g., 15 out of 20), using a default idleTimeout of 10 minutes, and sizing maximumPoolSize based on expected concurrent connections to
  • Lessons Learned #541:Automatic Plan Correction vs External Tables: A Practical Lesson from the Field by Jose M Jurado · 2 min read This article explains why queries referencing external tables may not always benefit from Azure SQL Database’s Automatic Plan Correction feature, as their performance depends on remote data sources and network factors, suggesting selective exclusion of such query IDs from FORCE_LAST_GOOD_PLAN.
  • 5 T-SQL features that should already exist (2026 SQL Server wish list) by Edward Pollack · 11 min read The article outlines five T-SQL features-such as native compressed file imports and improved JSON handling-that could greatly enhance SQL Server’s productivity for data engineers and developers in 2026.
  • Using Bulk Copy API for faster ingestion in Fabric Data Warehouse (Preview) by Jovan Popovic · 1 min read The Bulk Copy API in Fabric Data Warehouse (Preview) boosts client-side ingestion speeds by 5-10× over traditional T-SQL INSERTs, enabling faster direct writing of application-generated data into warehouse tables.
  • BulkSynchronize in EF Core: Mirror Your Data in One Operation by Chris Woodruff · 11 min read BulkSynchronize in EF Core automates inserting, updating, and deleting database rows based on a provided source list, eliminating the need for custom sync logic that can introduce bugs as data volume grows.
  • Microsoft Fabric–Why Are You So Down? by Joey D'Antoni · 4 min read Microsoft Fabric lacks transparent post-mortems and detailed incident histories compared to Azure and AWS, raising concerns about customer trust and support for its global users.
  • Learn T-SQL With Erik: Controlling Memory Grants by Erik Darling · 9 min read Erik explains how to manage memory grants in T-SQL queries, offering techniques like adding indexes and using Cross-Apply to reduce resource contention and improve performance.
  • Building an Azure architecture that’s ready for every signature by Michal Toiba · 6 min read Exclaimer built an Azure-based architecture using Kubernetes Service, SQL Database, PostgreSQL, Cosmos DB, Data Explorer, and Databricks to handle 80k customers, 9.6M seats, and over 21B emails annually while ensuring high availability, regional data compliance, and cost efficiency
  • SQL Server 2016 Extended Security Updates: Stay Protected While You Modernize by Venkata Raj Pochiraju · 4 min read SQL Server 2016 Extended Security Updates provide up to three years of continued security patches until July 17, 2029, helping organizations maintain protection while they plan modernization or upgrade paths.
  • Data sync fails with deadlock error by Smriti Gupta · 2 min read The article explains how to resolve deadlock errors that cause data sync failures in Azure SQL Data Sync by adjusting synchronization settings, optimizing system tables, and planning for the service’s retirement on September 30, 2027.
  • Azure SQL DB Fabric Mirroring with Private Endpoint by Shaurya Singh · 2 min read Azure SQL DB Fabric Mirroring with a Private Endpoint requires the source database to be on Standard Tier with at least 100 DTUs, enables System Assigned Managed Identity on the logical server, registers Microsoft.PowerPlatform as a subscription-level source provider, and configures the Virtual Network Subnet to delegate Microsoft.Power
  • mssql-python 1.10.0: Service Principal Bulk Copy, More Reliable Arrow Text, and a Core Timeout Fix by David Levy · 1 min read mssql-python 1.10.0 introduces bulk copy support for ActiveDirectoryServicePrincipal service principals, improving enterprise automation compatibility, enhances Arrow text reliability across platforms with consistent Unicode handling, and resolves bulk load connection timeout issues in the core library.
  • Announcing Microsoft.Data.SqlClient 7.0.2 and 6.1.6 by David Levy · 2 min read The new servicing updates for Microsoft.Data.SqlClient 7.0.2 and 6.1.6 introduce Web Account Manager (WAM) broker support for Entra ID authentication modes on Windows, hardened TDS token parsing to prevent protocol attacks, fixes for null-reference issues in SqlDataReader and Always Enc
  • Microsoft Django backend for SQL Server -mssql-django 1.7.3 is now available by David Levy · 2 min read mssql-django 1.7.3 enhances SQL Server connectivity for Django by robustly parsing modern authentication settings and fixing a subclassing bug in server-property caching, ensuring smoother integration with advanced authentication scenarios.
  • SQL Server Performance Office Hours Episode 65 by Erik Darling · 9 min read In Episode 65, Erik Darling discusses why SQL Server often grants large memory allocations to trivial queries and explores the implications for query performance optimization.
  • Scaling EF Core for Data Imports: From CSV Files to Millions of Database Rows by Chris Woodruff · 10 min read Bluesky introduces a production-ready EF Core import pipeline that processes a nightly 500 k-row supplier catalog in under five minutes using CsvHelper DTOs, chunked streaming, and bulk insertion with ChangeTracker disabled.
  • SQL Server as a Document Database — and why you want that! by Jeremy D. Miller · 8 min read Polecat enables SQL Server 2025 to function as a document database with native JSON support, mirroring Marten's API for seamless productivity gains without migrations or mapping files.

🛠️ Developer tools

🔩 DevOps

🧬 Hybrid + multicloud

🎭 Identity

🔌 Integration

  • Getting Started With NATS JetStream in .NET by Milan Jovanovic · 4 min read Getting Started With NATS JetStream in .NET introduces a lightweight, fast messaging system that runs as a single binary with no external dependencies, offering durable queues through its JetStream layer and providing an easy-to-use .NET client for seamless integration.
  • MCP Server Authorization with Azure API Management: From Simple to Advanced by vzisiadis · 12 min read Azure API Management integrates with the Model Context Protocol (MCP) to provide robust authorization options-from simple token validation to interactive OAuth sign-in-enabling fine-grained control over who can access MCP servers and what actions they may perform.
  • Event Sourcing: Aggregates, Dynamic Consistency Boundaries, or what? by Urs Enzler · 7 min read This article explores consistency boundaries in event sourcing, comparing traditional aggregates from Domain-Driven Design to the newer Dynamic Consistency Boundaries approach, highlighting why they matter for preventing incorrect data displays and how different systems handle these challenges.

💡 Internet of Things

  • Azure IoT guidance for DigiCert Global Root G1 trust-store updates in sovereign clouds by Jesús Barranco · 3 min read This guidance explains how recent updates to operating system trust stores in Azure Government (Fairfax) and Azure China (Mooncake) environments may remove trust for the DigiCert Global Root G1 certificate, potentially causing TLS connectivity issues with Azure IoT devices and applications that rely on those updated trust stores.

🎓 Learning and Certifications

⚖️ Management and Governance

  • 10 things to know before enabling Microsoft 365 Backup by Aditi Gangwar · 6 min read Before enabling Microsoft 365 Backup, know that it offers resiliency with compliance built in, fast restore speeds up to 1-3 TB per hour, is designed for bulk recovery after ransomware attacks, provides both daily fast and granular restore points, and supports scalable configuration via dynamic
  • The governance shift: RBAC, URBAC, data lake, and MSSP by Mohit Kumar · 11 min read Defender's governance shift introduces Unified RBAC (URBAC) that coexists with existing Azure RBAC, enabling data-scoped cross-workspace permissions and tiered data models while preserving current role assignments.
  • The Data Collector API Is Going Away: How to Migrate Your Azure Monitor Logs by Piotr Kolodziej · 5 min read The Data Collector API for Azure Monitor Logs will retire on September 14, 2026, forcing users to migrate to the newer DCR-based custom log ingestion method that offers better authentication and schema control.
  • Modernizing Nonprofit Operations with Power Automate by Tiffiany · 2 min read Power Automate helps nonprofits automate routine tasks like donor thank-you emails, volunteer application routing, and event registration with low-code logic, connectors to tools such as Outlook and SharePoint, and real triggers tied directly to business events.
  • From insight to action: The next phase of agentic cloud operations by Pang Ngernsupaluck · 5 min read Agentic cloud operations at Azure integrates AI-powered agents that turn real-time insights into governed actions, streamlining hybrid infrastructure management with continuous optimization loops.
  • From Prompt to Provisioned: A Closer Look at the Azure Deployment Agent by Pierre Roman · 6 min read The Azure Deployment Agent transforms workload design by guiding users through architecture planning, grounding outputs in the Well-Architected Framework, and generating reviewable Terraform or Bicep code directly from natural language prompts.
  • Monday Ledger: The 5 Skills Your IT Team Needs to Support AI Infrastructure by Jennifer Stirrup · 6 min read The article identifies five critical skills-model monitoring, token and cost management, prompt governance and versioning, data fluency for interpreting model outputs, and cross-functional collaboration-that cloud teams typically lack when supporting AI infrastructure.
  • EU Azure Regions Capacity – June 2026 by Aidan Finn · 6 min read Azure regions in the EU for June 2026 face deployment failures due to regional provisioning restrictions, requiring users to select alternative locations or submit support requests for exceptions.
  • Azure Resource Group vs Management Group by Rajkishore Sahoo · 5 min read Azure Management Groups serve as high-level governance containers for organizing subscriptions, while Resource Groups are granular lifecycle containers that hold individual deployed Azure assets like VMs and storage accounts.
  • Azure Copilot Observability Agent is generally available, with autonomous operations in preview by Efrat Nauerman · 4 min read The Azure Copilot Observability Agent, now generally available with autonomous operations in preview, transforms alert noise into investigated issues by integrating AI reasoning across telemetry, resource context, and custom instructions to help teams quickly identify changes, correlations, and evidence for resolving problems while maintaining human oversight.

🚌 Migration

  • Deploy an Azure Landing Zone in About Twelve Minutes with the ALZ IaC Accelerator by Pierre Roman · 6 min read The ALZ IaC Accelerator dramatically reduces Azure Landing Zone setup from weeks to just twelve minutes, automating management groups, policies, networking, and CI/CD pipelines while supporting both Bicep and Terraform.
  • What I learned preparing for Cloud Migration and Modernization of Microsoft by Radu Vunvulea · 5 min read Preparing for cloud migration audits requires proving repeatable capabilities with clear evidence, focusing on candidate projects, thorough pre-assessment, and structuring evidence packs to meet audit requirements effectively.
  • Build a Sovereign Private Cloud with Azure Local by Pierre Roman · 6 min read Azure Local enables organizations to meet strict regulatory data residency requirements, support sovereign AI workloads, operate in disconnected environments, ensure business continuity with a local fallback plan, and achieve low-latency performance by providing a cloud-consistent control plane on hardware you can physically manage.

🌐 Networking

  • Public Preview: Application Gateway for Containers – Inference gateway by The Azure Updates Team · 1 min read Application Gateway for Containers introduces an inference gateway that integrates the Kubernetes Gateway API Inference Extension, allowing seamless AI model serving directly within containerized environments.
  • A real look at BYON Microsoft Foundry by Dan Rios · 11 min read BYON Foundry in Azure provides private, internal networking for organizations with strict security and regulatory requirements, offering control over routing and egress at a higher operational and financial cost compared to the managed VNet option.

🔐 Security

  • Azure Updates – Number 140 – June 27, 2026 by Andrew Lowes · 1 min read Azure Update #140 highlights new features for Architecture, Compute, Security Copilot, and Sentinel, streamlining recent releases for developers.
  • Securing the Industrial Edge: A Guide to Microsoft Defender for IoT by Kuganesha Nadaraja · 4 min read Microsoft Defender for IoT offers agentless security for industrial protocols via a decentralized architecture with OT sensors, integrated with Azure…
  • New Security Controls in Edge for Business by Zachary Cavanell · 8 min read Edge for Business extends conditional access, Purview DLP, and Defender controls to all browser sessions on both managed and unmanaged devices, automatically blocking sensitive data from reaching unauthorized AI services and managing clipboard and screenshot actions by location.
  • Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access by Microsoft Defender Security Research Team · 25 min read The Photo ZIP campaign uses photo-themed ZIP archives with Node.js implants to gain persistent access in the hospitality industry, employing obfuscated PowerShell and dual registry persistence for stealthy operations.
  • Choosing the right AI model in Microsoft 365: flexibility, control, and confidence by KwekuMSFT · 4 min read Choosing the right AI model in Microsoft 365 lets organizations balance flexibility with enterprise-grade governance, offering options from default hosted models to independent providers like Anthropic, all managed through centralized admin controls.
  • What’s new in Microsoft Intune – June by Scott Sawyer · 5 min read Microsoft Intune introduces AI agents for secure user interactions with company data, auto-updates for enterprise applications to reduce vulnerability exposure, and a new Vulnerability Remediation Agent prioritizing CVEs across Windows devices, enhancing security posture.
  • Microsoft a Leader in The Forrester Wave™ for Endpoint Management Platforms by Jason Roszak · 5 min read Forrester recognizes Microsoft Intune as a leader in endpoint management for its integrated approach using Azure Entra, Defender, Windows, and 365, offering unified device management across platforms with AI-powered privilege management and security assistance.
  • Building Practical Rowhammer Protection into Azure Cobalt 200 by Stefan Saroiu, Alec Wolman, Anant Deval, Sashi Majety · 5 min read Azure Cobalt 200 incorporates advanced Rowhammer protection directly into its memory controller, using a hybrid design that balances performance and security without adding measurable overhead, as detailed in a recent research paper presented at ISCA 2026.
  • Microsoft Sentinel Baseline Deployment: From Zero to Operational SOC – Summer Bonus! by Andrew Lowes · 1 min read The bonus guide shows how to automate Sentinel’s core processes, enabling teams to maintain workspace health, enforce policies, and focus SOC staff on strategic initiatives.
  • Azure Confidential Computing for Digital Sovereignty and Regulated Workloads by Vikas Bhatia · 6 min read Azure Confidential Computing is expanding its hardware-rooted security across multiple processors, regions, and services to meet growing digital sovereignty, regulatory compliance, and AI privacy demands.
  • CNAPP evolution: How Microsoft aligns with leading cloud risk management platforms by Microsoft Security Team · 4 min read Microsoft’s CNAPP solution integrates risk correlation across identity, endpoints, data, and cloud environments to prioritize exploitable threats, extending security from code through runtime and SOC workflows for continuous operational risk reduction.
  • Taming AI Tool Sprawl: A PowerShell Guide to Auditing and Governing Unauthorized AI Applications by Adam Bertram · 1 min read Use PowerShell alongside Azure services like Graph, Entra ID, and Defender for Cloud Apps to detect and control unauthorized AI applications effectively.
  • Unify Your SOC: Integrating Defender XDR with Sentinel by Adam Bertram · 1 min read Integrating Defender XDR with Sentinel unifies security incident response, streams endpoint events, enhances detection capabilities across products, and supports seamless SOAR automation.
  • Guarding AI memory by Natalie Isak, Sarah Cooley · 6 min read Guarding AI memory involves protecting both personalization and agentic coherence while addressing unique attack vectors like delayed tool execution through adversarial memory poisoning, with Microsoft 365 implementing defense-in-depth measures across creation, storage, retrieval, model interaction, and user control.
  • Automate Your SOC: A Guide to Sentinel Playbook Generation by Adam Bertram · 1 min read This guide shows how to use AI to automatically generate secure, tested Microsoft Sentinel Python playbooks, complete with integration profiles for smooth SOC automation deployment.
  • One intrusion, two cyberattackers: Uncovering parallel threat activity by Microsoft Incident Response · 4 min read The report details how a single ransomware intrusion uncovered parallel activities from two separate threat actors using blended tactics that obscured signals and challenged traditional views of multi-stage campaigns in hybrid environments.
  • Post-Quantum Cryptography and Crypto-Agility by Michael Howard · 10 min read Crypto-agility-designing systems so cryptography can be updated without disruption-is essential for resilient post-quantum transitions, requiring abstraction, configuration, and testing rather than hard-coded algorithms.
  • The state of MCP security in 2026 by Jitesh Thakur · 5 min read In 2026, the Model Context Protocol (MCP) faces evolving security risks such as prompt injection and tool poisoning, authorization vulnerabilities like the confused deputy, and over-broad access issues, with recent spec updates introducing tighter identity checks and new MCP Apps capabilities to enhance sandboxed UI interactions.
  • How to Configure macOS Privacy Preferences Policy Control (PPPC) Using the Intune Settings Catalog by Intune Support Team · 3 min read Configuring macOS Privacy Preferences Policy Control in Intune requires matching the app identifier, code requirement from its signature, and using Authorization instead of Allowed to prevent apps from breaking or operating quietly without proper permissions.
  • Best practices for deploying Secure Boot certificate updates by Nuno Costa · 5 min read Best practices for deploying Secure Boot certificate updates emphasize early testing, layered deployment approaches, and using the right mix of tools like Intune or Group Policy to ensure smooth rollouts across diverse Windows environments.

📦 Storage

  • Generally Available: Azure NetApp Files migration assistant by The Azure Updates Team · 1 min read The Azure NetApp Files migration assistant, featuring SnapMirror, streamlines and reduces costs during data transfer by utilizing ONTAP’s native replication capabilities to move data between on-premises environments, Cloud Volumes Online, or other clouds to Azure NetApp Files.
  • 348 - Updates to Azure Files in 2026 by Tobias Zimmergren, Jussi Roine · 1 min read Azure Files in 2026 introduces GA features like Entra-only identities, enhanced macOS access security, and preview support for Entra Kerberos authentication, streamlining cloud-first file share modernization.
  • Boost performance with NFS nconnect on Azure NetApp Files datastores for Azure VMware Solution by Geert van Teylingen · 9 min read nconnect on Azure NetApp Files datastores for Azure VMware Solution boosts performance by allowing a single NFS mount to use multiple TCP connections, increasing throughput and reducing latency under concurrency without needing additional datastores or hosts.

💻 Virtual Desktop Infrastructure

  • Azure Virtual Desktop vs Windows 365 by Rajkishore Sahoo · 6 min read Azure Virtual Desktop offers customizable IaaS/PaaS infrastructure for specialized environments with granular control over networking and resources, while Windows 365 provides a turnkey SaaS solution with instant provisioning via Intune, ideal for organizations prioritizing simplicity and predictability.
  • Point-in-time restore for Windows 11 is now generally available by Lia Vargas · 6 min read Point-in-time restore for Windows 11 lets IT teams quickly roll devices back to a previous stable state within minutes, automatically capturing system, apps, configs, settings, and local files every 24 hours via built-in recovery in the Troubleshoot menu of the Windows Recovery Environment.
  • What is Azure Virtual Desktop by Rajkishore Sahoo · 4 min read Azure Virtual Desktop abstracts infrastructure management, allowing enterprises to focus on applications while offering multi-session Windows licensing and FSLogix profile containers for efficient resource use and fast logins.
  • Azure Virtual Desktop Client by Rajkishore Sahoo · 6 min read The Azure Virtual Desktop client portfolio includes a Windows desktop app, web client for browsers, and specialized macOS, iOS, and Android clients, each optimized for different user needs and device types.

🔗 Web

Get Azure Weekly in your inbox every Sunday

Sign up to receive the email every week and keep on top of all the announcements.

Don't forget to confirm your subscription. We have a double opt-in sign up process to prevent spam.

We will never provide your details to any third parties. We don't spam.

Azure Weekly Logo