Azure Weekly
Issue 587
8th November 2026
There are a few interesting AKS and container related announcements this week - possibly building up to KubeCon + CloudNativeCon North America (9th-12th November).
- Announcing flex nodes for AKS (preview) in Azure portal by Samantha Fernandez - Azure portal now offers guided creation of flex node pools for AKS, simplifying integration with user-managed virtual machines or on-premises servers while maintaining control over underlying hosts.
- Sync Without Shared Secrets: Managed Identity for ACR Connected Registry by zoeyli - Azure's Managed Identity for Connected Registry enables authentication of image sync without shared secrets via Azure RBAC and ABAC conditions, with automatic token refresh through Entra ID.
- Testing AKS Health-Aware Upgrade Gates in Preview by Richard Hooper - Azure Kubernetes Service (AKS) preview adds health-aware upgrade gates to pause automatic upgrades when instability is detected, improving reliability during maintenance.
There are also numerous announcements of new networking features and capabilities, so that section is worth reviewing this week. Two other articles which caught my attention this week:
- Why Did Our Azure Bill Change? Investigating Cloud Spend with Azure SRE Agent by Asitha De Silva - The Azure SRE Agent offers an interactive workflow linking Cost Management, Resource Graph, Advisor recommendations, and reusable skills to swiftly pinpoint cost drivers and produce customizable reports for FinOps teams.
- Inside GitHub’s new Git storage architecture by Karthik Raman, Brian Celenza - GitHub's new architecture supports thousands of concurrent agents handling up to 7,200 pushes per second with low latency reads, facilitating agentic development for hundreds of millions of developers.
And a reminder that Microsoft Ignite is happening from 17th to 20th of November. You can register for a free digital pass.
🤖 AI
- The Agentic Gatekeeper: Using Microsoft Decision-1 to Decide When Agents Act The Agentic Gatekeeper uses Microsoft-Decision-1 to swiftly and affordably assess AI agent actions, averting problems such as scope drift, irreversible damage, and prompt injection by outputting calibrated probabilities that result in ALLOW, ASK HUMAN, or BLOCK choices.
- From Writing Scripts to Running a Newsroom: A 24-Hour News Station with Microsoft Copilot Harness Meridian 24 uses the Microsoft Copilot Harness to automate a newsroom workflow, integrating editorial processes for coherent scripts before AI-generated speech synthesis, with long-running resilience protecting against production interruptions.
- Copilot Chat vs Copilot Cowork Copilot Chat provides secure AI chat within eligible Microsoft 365 licenses without a Copilot subscription, using only the content you provide or reference, whereas Copilot Cowork needs a license to delegate tasks such as email sending and document creation with real-time approval for sensitive actions.
- Build a Grounded Package Upgrade Advisor with Microsoft-Decision-1 The Microsoft-Decision-1 model uses Azure Foundry and Bing Custom Search to analyze release notes and security advisories, offering automated upgrade recommendations with urgency levels.
- Introducing SharePoint tools in Work IQ SharePoint Tools in Work IQ bring 60+ native operations to agents via the Work IQ MCP server, boosting task success rates by 14.5% and reducing token usage while enabling real work delegation like building trackers and generating deliverables from document libraries.
- An engineering guide to Claude Code on Microsoft Foundry with Azure API Management This guide explains how to integrate Claude Code with Microsoft Foundry via Azure API Management for developers to access the approved model while administrators handle identity, budgeting, and private networking in a secure enterprise CCOF setup.
- Rethinking Azure OpenAI Token Economics: Processing Nasdaq Level 2 Market Data Before AI Azure Container Apps services pre-process raw market data to filter noise, significantly reducing token costs by sending only relevant events to the LLM for final analysis.
- 5 Ways to Stop Azure AI Agents from Blowing Your Budget Prevent Azure AI agent overspending by implementing API management token limits, Application Insights monitoring, semantic caching, loop restrictions, and automated budget alerts.
- Episode 440: The J Factor: Bringing Your Experience to Generative AI In Episode 440 of the Microsoft Cloud IT Pro Podcast, Jay Leask and Norm Young explore how personal experience influences generative AI's impact on creativity, job roles, and the future of AI-assisted work.
- Stop treating agents as one-off projects and start running them as a continuous discipline The IDC InfoBrief highlights that only 17% of organizations model AI cost scaling, emphasizing the need for continuous management of AI as a business discipline rather than isolated projects.
- Microsoft Foundry October Recap Separates AI Agent Previews from GA Releases The recap separates preview features like the Copilot harness for AI agents from fully released capabilities such as browser automation and hosted-agent improvements in October’s Foundry update.
- Moonshot AI’s Kimi K3.1 Pro comes to Microsoft Foundry Kimi K3.1 Pro's 1-million-token context window and multimodal features allow developers to create efficient agentic applications for handling large codebases, research documents, and integrated text-image tasks in Microsoft Foundry.
- Models Are Everywhere. Your Context Isn’t. | Microsoft IQ Microsoft IQ unifies Work, Fabric, Foundry, and Web intelligence for AI agents, transforming diverse data into a strategic asset that improves decision-making.
- Copilot Studio | Works on My Agent, the New "Works on My Computer" Sharing connected agents in Copilot Studio requires separate sharing for each agent because parent-agent permissions do not extend to child agents, impacting workflow execution and external connections.
- Improve production agents with closed-loop evaluations in Microsoft Foundry Closed-loop evaluations in Microsoft Foundry automatically compare new agent versions against live traffic metrics, enabling safe, data-driven upgrades without manual prompt editing or model swapping.
- Building the next generation of multimodal AI experiences with fal in Microsoft Foundry The partnership introduces Kling, LTX, and MiniMax video models in public preview within Microsoft Foundry, offering developers tailored options for diverse creative and engineering video generation needs.
- Direct your next shot with fal on Microsoft Foundry and ComfyUI Integrate the fal MiniMax H3 Max video model and Foundry image models (gpt-image, FLUX, MAI Image) into ComfyUI using custom nodes and keyless Microsoft Entra ID authentication for a cinematic image-to-video pipeline without a GPU or API keys.
- The AI-Native Enterprise: When Organizations Become Software The AI-native enterprise shifts focus from day-to-day management to purpose and constraints under human leadership, possibly redefining competitive advantage through organizational design.
- Web search for your agents with Microsoft Web IQ Microsoft Web IQ provides a standalone API for efficient web search and content grounding with low latency, integrating easily across various platforms.
- The Model Isn’t the Boss: An Azure Architecture for Accountable AI Agents The Model Isn’t the Boss outlines an Azure architecture separating nondeterministic AI reasoning from authoritative action and execution to ensure accountable AI agents.
🔎 Analytics
- Vector Search vs. Knowledge Graphs: Where Microsoft Fabric Graph Fits Microsoft Fabric Graph unifies vector search and knowledge graphs in Azure, enabling complex path analysis across connected data for applications like local government evidence labs.
- Can Fabric Copilot Run on a Separate Capacity? Fabric Copilot can be billed to a dedicated F2 capacity while keeping your main workspace on a separate existing capacity, allowing you to manage costs and workloads independently.
- Fabric Capacity Smoothing: Why This Morning’s Job Is Slowing This Afternoon’s Reports Fabric's capacity smoothing spreads background operation costs over 24 hours, potentially slowing future interactions.
- Copilot on the Power BI Report Canvas vs. Modern Report Builder Copilot on the Power BI report canvas creates native reports with existing tools, whereas Modern Report Builder builds custom analytical applications using Fabric Apps, focusing on agentic functionality beyond simple reporting.
- An Implementation Plan for Evaluating AI Agents on Databricks Databricks’ MLflow tool integrates with Databricks to evaluate AI agents on accuracy, safety, relevance, and efficiency through automated scoring, expert calibration, and continuous monitoring.
- Microsoft Fabric Connectors for reading and writing existing Microsoft Fabric data The new Rayfin connectors in Microsoft Fabric allow seamless data interaction, enabling a database schema to act as an interface between two applications while giving citizen developers control.
🖥️ Compute
- Windows Server October 2026 monthly security updates impact SCVMM environments The October 2026 Windows Server security updates cause HTTP 500 errors and UInt64 overflow exceptions in SCVMM environments, requiring specific rollbacks or hotfixes for AMD processors.
- Windows news you can use: October 2026 October 2026 Windows update adds a new restore summary feature, improved Cloud rebuild option for PC restoration, and extended IT privileges for standard users via Intune Endpoint Privilege Management.
- Predicting and detecting failures: How Azure strengthens reliability for mission-critical workloads Azure's AFPD system uses machine learning to reduce VM interruptions by 36% and enable live migration for seamless workload protection.
- Designing Azure silicon on Azure silicon: EDA workloads on Cobalt 200 Azure Cobalt 200 significantly enhances EDA workload performance boosting simulation, verification, and timing analysis speeds from 1.30x to 4.15x faster than Cobalt 100 through optimized core architecture and high memory bandwidth.
🚢 Containers
- Announcing flex nodes for AKS (preview) in Azure portal Azure portal now offers guided creation of flex node pools for AKS, simplifying integration with user-managed virtual machines or on-premises servers while maintaining control over underlying hosts.
- Dapr Workflow: code that picks up where it left off Dapr Workflow automatically resumes interrupted processes by recording each step's outcome, enabling a document extraction service to continue from the last completed task after crashes or timeouts.
- Testing AKS Health-Aware Upgrade Gates in Preview Azure Kubernetes Service (AKS) preview adds health-aware upgrade gates to pause automatic upgrades when instability is detected, improving reliability during maintenance.
- Implementing Traefik as an Ingress Controller on Azure Kubernetes Service (AKS) Implementing Traefik as an Ingress Controller on AKS involves deploying and configuring Traefik with Helm while setting up Azure Front Door Premium, Azure Private Link, and internal load balancers for private HTTPS routing.
- Sync Without Shared Secrets: Managed Identity for ACR Connected Registry Azure's Managed Identity for Connected Registry enables authentication of image sync without shared secrets via Azure RBAC and ABAC conditions, with automatic token refresh through Entra ID.
🗄️ Databases
- Generally Available: Restart databases in Azure SQL DB via the Azure portal Azure SQL Database users can now initiate database restarts or failovers directly through the Azure portal, eliminating the need for API scripting or support interactions.
- Generally Available: Change from virtual network integration to a private endpoint capable network configuration in Azure Database for PostgreSQL flexible server Azure Database for PostgreSQL Flexible Server can migrate from virtual network integration to a private endpoint-capable configuration, improving security and network flexibility with no downtime.
- Generally Available: Azure Database for PostgreSQL stable REST API version 2026-10-01 The newly GAed Azure Database for PostgreSQL REST API 2026-10-01 adds robust maintenance tools, immutable backups, and enhanced multi-tenant encryption for secure, scalable workloads.
- Public Preview: Extend immutability for PITR backups for Azure SQL Database and Azure SQL Managed Instance The public preview allows Azure SQL Database and Managed Instance users to extend their point-in-time recovery (PITR) backup immutability from 7 to 35 days to comply with regulations.
- My Team Is Growing, How Do I Structure Who Gets Access to What? Azure Cosmos DB recommends structuring access by job function and workload, using distinct control-plane and data-plane roles to limit privileges and prevent accidental overexposure as teams expand.
- Batch Mode on Rowstore SQL Server Indexes Batch Mode on Rowstore SQL Server indexes enhances aggregation query performance by processing data in batches, reducing overhead and improving speed for large datasets.
- New ransomware recovery guidance for Azure SQL Database and Azure SQL Managed Instance The new Azure Learn guide provides a seven-step ransomware recovery framework for SQL Database and Managed Instance, focusing on early containment, clean restore points, evidence preservation, and proactive hardening.
- mssql-python 1.17.0: more reliable bulk copy, faster pool recovery, and DB-API fixes mssql-python 1.17.0 improves bulk copy reliability after upgrades, fixes UTF-8 handling and dead connection recovery, enhances row count accuracy for multi-statement batches, and aligns Timestamp() behavior with PEP 249 standards.
- Using CosmosDB for Chat History and Semantic Caching Lino’s Azure Cosmos DB Conf 2026 session shows how to use the platform for both short-term chat history and long-term semantic caching, optimizing AI response times through vector similarity searches.
- Importing Excel files into SQL Server, Azure Edition Azure Functions triggered directly by Blob Storage events automate Excel-to-SQL migrations, eliminating the need for additional Logic Apps orchestration.
- ANSI String Concatenation in SQL Server 2025 and Azure SQL Database SQL Server 2025 adds the ANSI-standard `||` operator for string concatenation, converting non-string types and handling NULLs similarly to the `+` operator with implicit type conversion like CONCAT().
- PostgreSQL Performance Bottlenecks: Managing Connections and Read-Intensive Workloads Managing too many database connections in PostgreSQL can significantly slow performance by increasing memory and CPU usage; using a connection pooler like PgBouncer helps reuse existing connections, reducing latency and improving throughput for read-intensive workloads.
🛠️ Developer tools
- Retirement: Azure Fluid Relay Azure Fluid Relay will be retired on February 2, 2027, ending its availability and potentially disrupting dependent workloads, though the underlying Fluid Framework will remain open source.
- Deprecation of Legacy Web Browser Control The legacy Internet Explorer-based Web Browser Control in Microsoft Access will be deprecated on May 18, 2027, with version 2705, prompting users to switch to the Edge Browser Control for continued functionality and compatibility.
- Build an Offline AI Voice Notebook on Raspberry Pi with Microsoft Foundry Local Build an offline AI voice notebook on Raspberry Pi with Microsoft Foundry Local to capture, transcribe, and summarize spoken reflections locally without cloud upload.
- GitHub Copilot Fusion: choosing effort instead of models GitHub Copilot Fusion streamlines development by letting users select and compare multiple AI models within a single workflow, improving efficiency for both simple edits and complex engineering tasks.
- PowerShell 7.7 and DSC 3.3 with Jason Helmick Jason Helmick explains that DSC 3.3 is a lightweight cross-platform configuration engine driving tools like WinGet Configure and details PowerShell's approach to facilitating enterprise migration from Windows PowerShell 5.1 to version 7 with integrated security improvements.
- Extending Azure VM Image Automation with an MCP Operations Layer Azure DevOps pipelines gain an MCP interface that allows developers to query build metadata and trigger guarded image-baking tasks directly from Visual Studio Code Copilot Chat.
- Copilot Agent Kit, installation Installing the Copilot Agent Kit involves enabling relevant features, installing the Creator Kit, and completing setup in the Power Platform Admin Center within about 40 minutes.
- Local AI in GitHub Copilot: plenty of RAM, still out of memory? Reducing the MAI Code 1.1 Flash model's context size to 32,768 tokens or less was necessary for running it locally in GitHub Copilot due to insufficient GPU VRAM despite having four NVIDIA Tesla T4 GPUs and ample system RAM.
- VS Code 1.145 Expands Remote Agent Workflows, Adds Cron Automations VS Code 1.145 introduces a remote agent browser and canvas for enhanced workflow management, along with improved local automation flexibility and session control features.
- PowerShell MCP Server: Automate Windows Admin Tasks PowerShell MCP Server lets you automate essential Windows administration tasks by creating a secure, read-only API that Claude Desktop can interact with.
- Microsoft Shows How to Run Qwen Coding Agents Locally with GitHub Copilot Microsoft demonstrates running Qwen coding agents locally with GitHub Copilot, leveraging Foundry Local and NVIDIA hardware for enhanced performance and security.
- GitHub Copilot to End Support for JetBrains 2025.2 IDE Releases GitHub Copilot will no longer support the JetBrains 2025.2 IDE, shifting its minimum required version to 2025.3.x for upcoming plugin updates.
- Microsoft Details 53 GiB Local Coding Model for GitHub Copilot GitHub Copilot’s new 53 GiB local coding model leverages mixed-precision quantization to run efficiently on RTX Spark hardware, enabling faster and more accurate code suggestions.
- Before replacing LINQ, read what it becomes Replacing LINQ's Any predicate in Azure Service Bus reduced delegate allocation but only benefited certain input cases, revealing performance gains for specific workloads without justifying a general LINQ replacement.
- Microsoft Foundry Extension for Azure Developer CLI Reaches GA The GA release of the Microsoft Foundry Extension for Azure Developer CLI introduces a streamlined workflow for managing hosted AI agents throughout their entire lifecycle.
- If Syntax Was Never The Goal, What Is The Job Now? Microsoft Agent Framework powers a prototype team of virtual agents that generate project artifacts, though human oversight remains essential for scope control and consistency.
🔩 DevOps
- Azure DevOps: Fix "Acquiring an agent from the cloud" Azure DevOps resolves the “Acquiring an agent from the cloud” issue by recommending checks for pool saturation, job limits, network permissions, and firewall blocks before modifying YAML files.
- Force Security Scans with Azure DevOps Extends Templates The extended Azure DevOps template automatically fails builds and enforces required security scans via service connections, enhancing code protection.
- AI Applications Scanning in GitHub Advanced Security: Catching Prompt Injection in the Pull Request GitHub Advanced Security introduces AI applications that scan pull requests for prompt injection vulnerabilities, enhancing code safety with automated detection.
- GitHub Backup Tool - update 1.4.0.0 is out GitHub Backup Tool version 1.4.0.0 introduces automated daily backups and enhanced encryption for secure repository preservation.
- October 2026 Node.js vulnerabilities: Azure DevOps security guidance Azure DevOps provides tailored remediation guidance for Node.js vulnerabilities in October 2026, including specific patch levels and update processes for self-hosted agents and pipeline tools.
- Inside GitHub’s new Git storage architecture GitHub's new architecture supports thousands of concurrent agents handling up to 7,200 pushes per second with low latency reads, facilitating agentic development for hundreds of millions of developers.
- Cleaning up unaffiliated users in GitHub Enterprise Cloud with the GraphQL API This guide shows how to automate removing unaffiliated users from GitHub Enterprise Cloud via the GraphQL API and GitHub CLI, detailing listing, filtering, deletion processes, and exception handling.
- Beyond code generation: A developer’s guide to agentic engineering Agentic engineering on GitHub streamlines planning, building, verifying, and observing software using tools like Copilot, Slack/Teams integrations, and GitHub Agentic Workflows to maintain team alignment and productivity amid higher commit volumes.
🧬 Hybrid + multicloud
- Azure Local: 10 mistakes that can derail your deployment before it starts Azure local deployment failures frequently result from initial choices like opting for a hypervisor instead of a hybrid platform or omitting landing zone discussions, underscoring the need for careful planning and design reviews.
🎭 Identity
- Use Open.IdentityServer for OpenID Connect in an Aspire setup Open.IdentityServer integrates with ASP.NET Core Identity and Aspire to provide a comprehensive OpenID Connect server solution, supporting real-time authentication flows and secure token management for web applications and APIs.
- Microsoft Entra Global Secure Access: one offering for Private Access and Internet Access Microsoft Entra Global Secure Access unifies private and internet access under one offering, applying Zero Trust principles without needing separate tools or policies.
- Microsoft USER (User Security Evaluation Reporter) Rearchitected for Entra ID The rearchitected Microsoft USER tool runs securely as a Node 24/TypeScript web app on Azure App Service, using Entra ID for authentication and managed identities to access the Microsoft Graph API.
- Scale access controls with Microsoft Entra Conditional Access policy plans Microsoft Entra Conditional Access policy plans simplify enterprise-scale access control by defining security intent once and enforcing it consistently, improving clarity and reducing administrative overhead.
- Entra MemberOf replacement heads behind Governance paywall Microsoft is moving the Entra MemberOf replacement into its Entra ID Governance service, introducing a licensing fee that may increase costs for organizations managing basic group permissions.
- Entra Agent IDs: How to Stop AI Privilege Escalation Entra Agent IDs structure prevention of AI privilege escalation through mapping four key objects, following four paths for tenant control, and applying eight security controls.
- Agent Governance on Microsoft Foundry, Part I: Which identity makes the call? Agent Governance on Microsoft Foundry details how Entra identities, managed identities, and Azure RBAC collaborate to authorize agent-service interactions, emphasizing each identity's unique role in authentication and authorization.
- Passkey Provider AAGUIDs PowerShell Module Now Refreshes Automatically Every Week The Passkey Provider AAGUIDs PowerShell module automatically refreshes its cached AAGUID list weekly via GitHub Actions and publishes updated versions to the PowerShell Gallery without user intervention.
- Microsoft adds hard deletion protection for Entra ID With the new hard deletion protection, Entra ID prevents permanent removal of user accounts for seven days, complemented by Protected Actions and Conditional Access controls in the preview.
- Microsoft Graph API MCP Server: Automate User Provisioning The new Microsoft Graph API MCP server automates user provisioning by enabling developers to create disabled test accounts, apply licensed permissions, and verify success via a Python local server.
- What’s new in Microsoft Entra: November 2026 Microsoft Entra launches lifecycle policies, drift detection, group discovery, phishing-resistant MFA, and rapid continuous access evaluation for agent and guest identities.
🔌 Integration
- Generally Available: Geo-Replication on partitioned namespaces for Azure Service Bus Premium Azure Service Bus Premium now offers geo-replication for partitioned namespaces, enabling high-throughput messaging across regions with automatic failover and sub-second latency.
- Announcing general availability of Geo-Replication on partitioned namespaces for Service Bus Premium Azure Service Bus Premium now offers general availability of geo-replication for partitioned namespaces, enabling high throughput and regional message reliability by replicating data and configuration to a secondary Azure region.
- Connector Namespace to simplify exposing a SQL table via an API Connector Namespaces streamline exposing a SQL table via an API by reducing development and deployment overhead, though the author hopes for even greater simplicity in future updates.
- Build an AI-assisted invoice approval workflow with Power Automate and AI Builder This tutorial demonstrates how Power Automate and AI Builder automate invoice validation against SharePoint purchase orders, routing valid invoices for review while flagging issues such as missing PO numbers or duplicates.
- Logic Apps Standard custom code now supports .NET 10 Azure Logic Apps (Standard) now supports .NET 10 custom code in Visual Studio Code, allowing seamless migration of existing .NET 8 projects without converting to separate Azure Functions apps.
💡 Internet of Things
- Azure IoT Central will be deprecated in 2029. Now what? Azure IoT Central will sunset in 2029, prompting organizations to explore alternatives like Azure IoT Hub or third-party SaaS platforms for their IoT solutions.
- IoT Hub with ADR and Certificate Management – Part 1 The new Azure IoT Hub series introduces automated Device Provisioning Service integration, managed certificate issuance via ADR, and a 3D-printed Skittle sorter demo using the latest preview of the Microsoft.Azure.Iot.Device SDK version 2.0.0-preview4.
- IoT Hub with ADR and Certificate Management – Part 2 Azure IoT Hub's Device Provisioning Service now supports X.509 onboarding with a bootstrap certificate and CSR flow, allowing direct device authentication and receipt of operational certificates from Azure Device Registry for secure, scalable IoT deployments.
- IoT Hub with ADR and Certificate Management – Part 3 The updated Azure IoT CLI script creates system-assigned identities, links Device Provisioning Service before the IoT Hub, and integrates certificate management with ADR using X.509 onboarding and CSR issuance enabled by default.
- IoT Hub with ADR and Certificate Management – Part 4 The new Azure IoT certificate management preview uses a two-phase approach for device authentication, issuing operational X.509 certificates with configurable lifespans from the namespace’s ADR CA via CSR submission, enhancing security over manual key transport methods.
- IoT Hub with ADR and Certificate Management – Part 5 This version introduces unified SDK clients for provisioning and telemetry using Azure IoT Device v2.0-preview4, replacing custom C# code while maintaining support for symmetric-key/X.509 profiles and CSR onboarding flows in the IoT Hub with ADR and certificate management series.
🎓 Learning and Certifications
- ChatGPT runs on Azure Cosmos DB. Prove you can build what’s next. The DP-420 certification focuses on building AI applications with Azure Cosmos DB including vector and hybrid search, RAG, agent memory, and conversation state, offering free onsite testing for registered attendees at the upcoming Microsoft Ignite event in San Francisco.
- Windows Server at Microsoft Ignite 2026: Sessions, our booth, and how to join the pre-day The Windows Server pre-day workshop provides insights on server management in cloud environments and previews AI, security, and networking upgrades for $325 as an additional fee to Ignite registration.
- Microsoft Foundry for Beginners: Deploy Your First Model and Write Prompts That Work This beginner’s video guides viewers through deploying their first AI model in Microsoft Foundry and creating effective prompts to aid in passing the Azure AI Fundamentals (AI-901) certification exam.
- Keep learning, keep building! Make the most of VSLive! with your Visual Studio Subscription VSLive! provides hands-on labs, expert tours of new tools such as Copilot and Microsoft Foundry, and interactive AI comparisons, offering up to $900 discounts for Visual Studio subscribers.
- Your guide to FinOps for AI at Microsoft Ignite 2026 FinOps for AI at Microsoft Ignite 2026 focuses on integrating finance, IT, engineering, and business teams to optimize AI spend predictability, accountability, and real business value delivery.
- Microsoft Entra deep dives: Join our December 15–17 webinar series The December 15-17 webinar series following Ignite will cover scaling secure access, strengthening governance and resilience across identities, and managing AI agents with practical scenarios and new capabilities to enhance identity security.
- People are the difference: The learning culture behind Investec’s workforce transformation Investec transformed its workforce by fostering a learning culture and people-first mindset through Azure certifications and continuous training for cloud and AI adaptation.
- Catch Microsoft Entra at Ignite 2026 At Ignite 2026 explore live sessions on user and AI agent security with keynotes from top execs and demos of new Entra features for combating identity attacks and simplifying access policies.
- GitHub Universe: Where MVPs and GitHub Stars share ideas and build community together GitHub Universe gathered numerous Microsoft MVPs who are GitHub Stars to promote knowledge sharing via hands-on projects such as custom nameplates and makerspace activities, emphasizing community connection over technical tools.
- Visual Studio Subscribers Offered Up to $900 Off VSLive! Events Visual Studio subscribers can receive up to $900 off at VSLive! events, along with access to hands-on developer training sessions.
- Recent and upcoming Microsoft exam changes – Saturday 7 November 2026 The post details recent and upcoming changes to several Microsoft certification exams, with a focus on updates to the SC-100: Microsoft Cybersecurity Architect exam scheduled for 7 November 2026.
⚖️ Management and Governance
- Article 5 - The 90-Day Agent Governance Plan The 90-day Agent Governance Plan outlines a practical method to discover, own, and map AI agents before implementing policies, transitioning from general awareness to precise control over agent usage.
- Why Did Our Azure Bill Change? Investigating Cloud Spend with Azure SRE Agent The Azure SRE Agent offers an interactive workflow linking Cost Management, Resource Graph, Advisor recommendations, and reusable skills to swiftly pinpoint cost drivers and produce customizable reports for FinOps teams.
- From Proactive Detection to Action: How Azure Protects Mission-Critical Workloads Azure's AFPD system employs machine learning and telemetry to predict, detect, mitigate, and remediate hardware failures in critical workloads, minimizing disruptions through proactive monitoring and notifications.
- Ghosts in the Directory Switcher: Cleaning Up the Azure Tenants You Forgot You Joined Azure directory switchers often accumulate stale guest accounts from past consulting projects, creating security risks that require manual cleanup through the portal settings.
- Who, not just what: Identity-aware Azure Policy for real-time governance Azure Policy now evaluates the requesting identity to govern both what changes are allowed and who can perform them, demonstrated by blocking manual deletions, requiring MFA for sensitive operations, and allowing only approved tools.
- Preparing Your IIS VM for Azure SRE Agent: A Reader-Only Guide This guide explains how to configure an Azure IIS virtual machine so the SRE Agent can collect essential logs, metrics, and configuration data for effective diagnosis without needing to run commands on the server itself.
- Automate Azure Cleanup with Bicep Deployment Stacks Automate Azure cleanup using Bicep by creating a deployment stack that previews deletions, ensuring resources are removed efficiently without unexpected charges.
🚌 Migration
- Generally Available: Azure Site Recovery for Azure Local Azure Site Recovery's GA for Azure Local simplifies enterprise disaster recovery with seamless protection for Windows and Linux VMs, enhancing security and reducing setup complexity.
- Generally Available: Enhanced Azure Site Recovery support for VMSS Flex Azure Site Recovery’s new GA feature enhances disaster recovery for VMSS Flex by streamlining target setup and reducing failover time to under 10 minutes.
- Public Preview: On-prem NAS share discovery and assessment are now available using Azure Migrate Azure Migrate’s public preview introduces on-premises NAS share discovery and assessment capabilities for Dell PowerScale (OneFS) and NetApp ONTAP, enabling more accurate migration planning to Azure.
- Migrate Arc-registered SQL Server instances to Azure without deploying the Arc agent Azure now allows direct migration of Arc-registered SQL Server instances to Azure SQL Managed Instance, SQL Server on Azure VMs, or Azure SQL Database via Log Replay Service, backup and restore, or Azure Database Migration Service.
- Discover and assess on-premises Network Attached Storage (NAS) shares using Azure Migrate Azure Migrate's new NAS share discovery and assessment preview automates inventory across Dell PowerScale/Isilon and NetApp ONTAP clusters, offering readiness scores, Azure service recommendations, cost estimates, and integrated planning tools for smooth migration.
🌐 Networking
- Generally Available: Route maps for Azure Route Server Azure Route Server’s new route maps offer detailed management of inbound and outbound routing for hybrid connections, enhancing network configuration flexibility.
- Generally Available: WAF Insights for Azure Application Gateway Azure’s WAF Insights GA provides integrated dashboards for visualizing and investigating blocked requests from consolidated log and metric data.
- Generally Available: Azure Front Door TLS key exchange policy with post-quantum support Azure Front Door now offers a GA TLS key exchange policy with post-quantum support to protect connections from future quantum threats while staying compatible with current clients.
- Public Preview: Private ingress for Application Gateway for Containers Application Gateway for Containers introduces private ingress capabilities via Azure Private Link, allowing secure, internal-only access to containers without exposing them to the public internet.
- Public Preview: MCP gateway for Application Gateway for Containers The public preview introduces an MCP gateway enabling seamless Model Context Protocol routing within Application Gateway for Containers, centralizing MCP server management with built-in TLS and authentication.
- Public Preview: JWT validation for Application Gateway for Containers Application Gateway for Containers introduces public preview of JWT validation via AuthPolicy, enabling teams to verify token authenticity, issuer, expiration, and audience with secure key retrieval from trusted sources.
- Public Preview: Azure Firewall IPv6 now supports application rules Azure Firewall’s new IPv6 public preview introduces application rules for layer 7 filtering of IPv6 HTTP and HTTPS traffic, supporting dual-stack environments and enhancing security consistency.
- VWAN simulator: a digital twin for Virtual WAN The VWAN simulator is an AI-powered tool allowing network admins to model Azure Virtual WAN topologies in real time, auto-generating routing tables and identifying issues such as asymmetric routing without registration or data upload.
- What if your Azure Databricks workspaces have overlapping CIDRs? Azure Databricks recommends using uniquely addressed private endpoints in a Transit VNet to avoid overlapping CIDRs, enabling enterprise users to privately access workspace services without routing through shared compute networks.
- Route summarization in Azure Route Server Azure Route Server's new route maps provide native policy control over hybrid network traffic, reducing route count via summarization and securing path selection across ExpressRoute, VPN, SD-WAN, and NVA connections.
- Azure Front Door now Supports Post-Quantum Resilient Hybrid TLS 1.3 Azure Front Door now supports hybrid post-quantum TLS 1.3 using NIST-standardized ML-KEM and classical elliptic curves to safeguard against future quantum threats while maintaining compatibility with current applications.
🔐 Security
- Retirement: OT security in Microsoft Defender for IoT Microsoft will retire its OT security feature in Defender for IoT by October 2029, prompting users to migrate to alternative industrial cybersecurity solutions during the three-year transition period.
- What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks This analysis shows that exploited vulnerabilities mainly facilitate system takeover, especially through remote code execution, privilege escalation, and authentication bypass, emphasizing the need for prioritized defense against high-likelihood and broad impact threats.
- Hunting Impossible Travel in Sentinel with KQL KQL allows security teams to build custom impossible travel detections that offer more transparency and tuning flexibility than Entra's built-in black-box risk signals.
- Fake-download campaign uses trojanized installers to deliver monetization payloads The campaign uses trojanized Inno Setup installers to covertly deliver various monetization payloads masquerading as software cracks and free utilities, installing proxies, compute, or adware via per-offer callbacks without user consent.
- What stops a service-side auto-labeling rollout from being approved — and how to unblock it Service-side auto-labeling requires addressing four core concerns regarding access, proof, reversibility, and scale to secure stakeholder approval.
- The CISO Cheat Sheet to Microsoft Digital Defense Report 2026 The 2026 Microsoft Digital Defense Report shows AI significantly cuts the time, expertise, and cost required for attackers to find and exploit vulnerabilities, shortening attack timelines and facilitating more autonomous cyber operations.
- Securing AI Adoption in the DIB-Part 2: Microsoft's Approach to Discovering & Securing AI Microsoft outlines a Zero Trust approach for securing AI adoption in the Defense Industrial Base, focusing on identity management, data governance, and lifecycle oversight with extended security for generative AI tools like Copilot.
- Security Fix: Azure Sphere SDK version 26.06.1 is now available The security fix releases Azure Sphere SDK version 26.06.1 to remove trust in compromised eMudhra intermediate CA keys, preventing potential man-in-the-middle attacks on authenticated TLS connections.
- Secure AKS with Microsoft Defender for Containers for Code-to-Cloud Security Defender for DevOps integrates with AKS to offer comprehensive code-to-cloud security by linking repository issues to cloud risk assessments, improving visibility for engineers and security teams.
- Email threat landscape: Q3 2026 trends and insights The report shows a 41% increase in email phishing threats to nearly 3 billion users in September 2026, with CAPTCHA-gated phishing rising due to SVG attachments, indicating new tactics beyond QR codes and traditional methods.
- What’s new in Microsoft Security: November 2026 The November 2026 update to Microsoft Security adds Dynamic Permissions, Secure AI for agent risk management, and enhanced least-privilege support in Intune Endpoint Privilege Management.
- New investments to reduce on-premises security risk Microsoft launches On-Premises Baseline Security Mode to automatically apply hardened security configurations to supported server workloads, reducing manual effort for maintaining strong defenses.
- Threat actors use agentic AI tooling to find and abuse exposed secrets Threat actors leverage agentic AI tooling to rapidly discover and exploit exposed secrets across GitHub, enabling swift cloud compromise and data exfiltration within minutes.
- Troubleshoot DataStream with VirtualMetric AI for Microsoft Sentinel VirtualMetric AI automates issue detection and diagnosis in the DataStream pipeline to Azure SIEM, improving incident response.
- ARTEX abuse expands as cybercriminals target financial sector Storm-3358 targets Southeast Asian financial institutions and global firms using the ARTEX agentic AI framework for vulnerability scanning, deploying open-source RATs with tools like netcat and curl, and conducting credential theft and lateral movement.
📦 Storage
- Generally Available: Azure Storage Actions adds automatic task updates, execution controls, and case-sensitive matching Azure Storage Actions now offers automatic task updates, fine-grained execution controls, and case-sensitive matching to streamline automated data workflows in Blob and Data Lake Storage.
- Public Preview: Advanced capacity insights are now available in Azure Storage Discovery Azure Storage Discovery's public preview offers advanced capacity insights like access patterns, data age, storage tiers, and object size distribution to enhance cloud storage efficiency.
- Public Preview: Multi-disk crash-consistent VM restore points for Premium SSD v2 and Ultra Disks on VMs with SCSI disk controller Azure offers a public preview of crash-consistent VM restore points for Premium SSD v2 and Ultra Disks using SCSI controllers, allowing seamless agent-less data recovery.
- Enhanced data protection for Azure Files Azure Files now provides vaulted backup for NFS shares, snapshot revert capabilities for rapid recovery, and Storage Mover support to keep secondary copies in any region, enhancing business continuity and disaster recovery.
- Accelerate data access for inference and training with the open-source distributed accelerator for cloud storage DACS speeds up AI tasks by caching often-used blob pieces on GPU nodes, lowering latency for datasets and models while still using Azure Blob Storage as the reliable backup.
💻 Virtual Desktop Infrastructure
- What’s new in Windows 365: October 2026 recap Windows 365 adds RDP Multipath and Shortpath improvements, session state retention in dedicated Flex mode, and extended external identity support via Windows App on iOS to enhance productivity and security.