Azure Weekly

Issue 578

6^th September 2026

Highlights this week include:

• GPT-6 Astra: Frontier intelligence for work, now generally available in Microsoft Foundry by Steve Sweetman, Naomi Moneypenny - GPT-6 Astra enables agentic workflows by interacting directly with desktop applications and software interfaces to execute multi-step tasks without requiring dedicated APIs.
• AI Agents Lie About Being Done by Martin Hinshelwood - Nearly 20% of AI agent sessions over six weeks included false statements later admitted by the agents, indicating deeper validation system issues beyond prompt improvements.
• Your Private Endpoint Does Not Cover Agent Egress: Locking Down Azure AI Foundry in Both Directions by Raffaele Garofalo - Azure AI Foundry's private endpoint secures only inbound traffic; agents can still reach out to tool endpoints from public IPs unless network injection is configured separately.
• Azure Firewall explicit proxy is now generally available by Devanshi Rastogi - Azure Firewall's new explicit proxy feature allows users to direct specific apps or browsers' HTTP and HTTPS traffic through the firewall, streamlining policy enforcement and decreasing dependence on external proxies.
• Scaling AI Storage: Azure Managed Lustre excels in MLPerf Storage v3.0 by Wolfgang De Salvador - Azure Managed Lustre significantly outperforms other hyperscalers in MLPerf Storage v3.0 with 642.2 GiB/s write throughput and sustained hundreds of GiB/s across a 25 PiB file system for training tasks.
• Microsoft Azure Virtual Desktop Hybrid is now generally available by Steve Downs - Azure Virtual Desktop Hybrid extends on-premises VDI to the cloud via Azure Arc for seamless management and user experience without full migration. And it's the end of an era:
• BizTalk Server 2020 End-of-Sale Announcement by Harold Campos - BizTalk Server 2020 sales will end on March 31, 2027, with mainstream support until April 12, 2028, and optional extended support until April 10, 2030, encouraging customers to migrate to Azure Logic Apps Standard or Hybrid.

🤖 AI

• Copilot Studio | Turning War Stories into Guardrails: Introducing pac-copilot-kit
  pac-copilot-kit automates Dataverse knowledge source creation and enforces ALM best practices via guardrails while offering optional MCP server integration for AI agents.
• Deploy and use the Foundry Model Router using Azure Bicep
  Deploying Foundry Model Router on Azure with Bicep simplifies intelligent AI routing by automatically selecting optimal models based on request complexity, cost, and latency, streamlining infrastructure as code management for scalable AI applications.
• Inside Microsoft’s marketing team: Scaling expertise with AI
  AI agents within Microsoft's marketing team use Azure Foundry to scale expertise, reduce coordination, support weekly product launches, and achieve 150% YoY growth with maintained quality.
• What’s New in Microsoft Copilot | August 2026
  This month's update to Microsoft Copilot adds user controls for effort levels and cost management in Cowork, enhanced visibility into credit usage with the /cost skill, a revamped Automations tab for better task management, and new capabilities for selective text handling and session sharing within Copilot Chat.
• Model Migration Process on Microsoft Foundry and Azure OpenAI
  Microsoft Foundry provides a six-phase framework to manage LLM migrations, preventing silent behavioral drift that breaks downstream code when models are updated or retired.
• Six Lessons for Reliable Agent Optimizer Gains on Harder Agents
  The experiments show agent optimizer's performance depends on high-quality search budgets, capable evaluators, and robust reflection models interpreting rich signals from diverse datasets.
• Stop Letting Agents Run the Workflow
  Multi-agent systems fail in production when LLMs own process logic, so developers should use a deterministic spine to control state transitions while delegating only bounded tasks to agents.
• Claude Fable 5.1 is now available in Microsoft Foundry
  Claude Fable 5.1 in Microsoft Foundry provides robust long-horizon reasoning and reliable execution for complex enterprise workflows, excelling in sustained tasks across coding, research, and agentic applications with safety safeguards on cyber and bio queries.
• Available today: Anthropic Claude Fable 5.1 in Microsoft Copilot
  Claude Fable 5.1 in Microsoft Copilot enhances capabilities for long-running tasks, financial analysis, and front-end visual coding using contextual data for more relevant AI responses.
• AI Agents Lie About Being Done
  Nearly 20% of AI agent sessions over six weeks included false statements later admitted by the agents, indicating deeper validation system issues beyond prompt improvements.
• White paper: Choosing between the GitHub Copilot and Standard harnesses in Copilot Studio
  The white paper compares GitHub Copilot and Standard harnesses in Copilot Studio, detailing their distinct strengths for bounded versus larger, coordination-heavy tasks to aid decision-making.
• The Economics of Agent Optimization: Context engineering for enterprise AI agents
  Context engineering in enterprise AI agents optimizes costs by strategically managing relevant information for the model's context window, enhancing performance without compromising quality.
• Decoding the new AI lingo: Loops, harnesses, squads, hill climbing… oh my!
  This article explains recent AI terms such as loop engineering, Ralph loops, squads, harnesses, and hill climbing to aid developers in navigating the evolving AI landscape.
• Bringing Open Models to Fireworks on Microsoft Foundry
  Fireworks on Microsoft Foundry integrates open AI models into Azure, offering identity governance, cost control, and security features while separating inference processing for better privacy and scalability.
• MAI-Transcribe-2: Highest quality transcription, at the fastest speed and lowest cost
  MAI-Transcribe-2 provides advanced multilingual transcription with fast speed, low cost, speaker diarization, word-level timestamps, and support for 60 languages ideal for enterprise use in contact centers, meetings, and media.
• Building 3IQ Retail Assistant Demo – Part 3
  The article shows how to integrate a Copilot Agent with a SharePoint List for customer support data, using Fabric Data and Foundry Prompt Agents to create an AI-assisted retail assistant that prioritizes external knowledge over LLM responses.
• Building 3IQ Retail Assistant Demo – Part 2
  The demo constructs a 3IQ Retail Assistant utilizing Azure resources, synthetic PDFs as knowledge sources, and Azure AI Search to develop a customized knowledgebase for addressing retail policy inquiries.
• Building 3IQ Retail Assistant Demo – Part 1
  3IQ Retail Assistant leverages Fabric, Foundry, and Work IQ to build an agentic customer service tool using AdventureWorks data and custom ontologies.
• GPT-6 Astra: Frontier intelligence for work, now generally available in Microsoft Foundry
  GPT-6 Astra in Microsoft Foundry turns open-ended goals into actionable plans, delivers polished outputs, executes complex workflows, and provides robust enterprise controls.
• Enterprise AI transformation relies on the end-to-end platform: Azure was built for this moment
  Azure’s end-to-end platform integrates models, infrastructure, data, applications, and developer tools to deliver seamless AI transformation for enterprises.
• Adaptive by Design: How Microsoft Discovery Explores Science
  Microsoft's Discovery Engine with CLIO outperforms other agentic harnesses in scientific domains by testing hypotheses, learning from failures, and adapting reasoning for better outcomes.
• GPT-6 Astra in Microsoft Foundry
  GPT-6 Astra in Microsoft Foundry offers an AI model with open-ended goal completion through planning, polished output generation, cross-application execution, a 1.05M token context window, enhanced reasoning levels (xhigh and max), and consumption-based pricing starting at $10 per million tokens for standard deployments.
• Choosing a real-time voice architecture on Microsoft Foundry: three enterprise patterns
  Choosing between real-time voice architectures on Microsoft Foundry involves weighing features, data residency, private networking, authentication, cost, and latency across three patterns direct API access BYOM with Voice Live or a prompt agent orchestrating most conversation flow.
• MAI-Image-2.6 and MAI-Image-2.6-Flash: Quality and speed at production scale
  MAI-Image-2.6 introduces multi-reference editing, web grounding, and enhanced format control for consistent high-quality visuals across marketing campaigns and product design, while MAI-Image-2.6-Flash offers twice the speed of GPT-Image-2-Medium with 78% greater efficiency for production-scale workloads.
• It Wasn't the Private Endpoint: Why the Foundry Playground Breaks Behind Private Networking
  The issue isn't Azure networking; the browser's Local Network Access feature blocks private calls from the Foundry playground, causing intermittent failures while other tools work correctly.
• Introducing Inside Microsoft Foundry: Quickstart 🎬
  Inside Microsoft Foundry: Quickstart introduces a video series guiding developers through building, testing, deploying, and governing AI agents with real-world challenges.

🔎 Analytics

• Learn What to Do When You Hit Capacity in Azure Databricks!
  Learn to resolve Azure Databricks capacity issues by working with your Microsoft account team, preparing detailed quota support tickets with subscription IDs, regions, VM SKUs, core limits, workload details, scaling plans, and business context, and understanding the three layered capacity models-Azure infrastructure, platform limits, and Spark execution-to address cluster creation stalls and autoscaling delays.
• Microsoft Fabric Data Agents: Bringing Structured and Unstructured Data Together
  Microsoft Fabric data agents unify structured and unstructured enterprise data for conversational querying with built-in governance.

🖥️ Compute

• Generally Available: Confidential VMs for Azure Linux
  Azure’s General Availability of Confidential VMs for Linux provides secure, isolated environments ideal for migrating high-sensitivity container workloads to AKS with built-in data protection.
• Deploy Windows Server vNext
  Deploying Windows Server vNext on a Ugreen NASync DXP4800 Plus lab environment showcases its secure, hybrid-ready architecture while emphasizing the requirement for UEFI Generation 2 hardware and modern NVMe storage.
• Why long-running tasks on Linux Batch pools can restart daily and how to prevent it
  The issue stems from Azure Batch Linux (Ubuntu) nodes’ default daily OS update job that restarts the node agent and causes tasks to be re-queued automatically.
• Deploying a VM into an Existing Virtual Network: ARM, Bicep, and Terraform
  This article explains how to deploy a virtual machine into an existing Azure virtual network using ARM templates, Bicep, and Terraform.

🚢 Containers

• Generally Available: Artifact Streaming on AKS
  Azure Kubernetes Service now offers generally available Artifact Streaming to speed up container workload scaling by incrementally pulling image layers from Azure Container Registry.
• Generally Available: Windows Server 2025 on AKS
  Windows Server 2025 on AKS provides enhanced security features and automatic updates, streamlining the transition from legacy Windows Server versions with minimal disruption to existing deployments.

🗄️ Databases

• Public Preview: Reader Endpoint for Azure Database for MySQL
  The public preview introduces a reader endpoint for Azure Database for MySQL, Flexible Server, automating load balancing and simplifying connection management across multiple replicas.
• Connecting Azure PostgreSQL to Oracle Autonomous with ORACLE_FDW
  Oracle_fdw enables direct SQL access to Oracle Autonomous Database from Azure PostgreSQL, allowing cross-database joins and data migration without building custom ETL pipelines.
• Understanding DevOps Auditing API Migration Behavior in Azure SQL Database
  Azure SQL maintains backward compatibility by allowing the legacy isDevopsAuditEnabled property on unmigrated servers, but after marking a server as migrated via dedicated API, requests for the legacy flag are ignored, causing inconsistent behavior.
• Troubleshoot Azure SQL Error 18456 for Microsoft Entra Group Users
  Azure SQL Error 18456 occurs due to orphaned login-based Entra group principals when their server logins are removed, emphasizing the need for contained database users and tracking principal dependencies.
• Filtered PostgreSQL Logical Replication for Microsoft Fabric Mirroring
  Filtered PostgreSQL logical replication mirrors necessary data into Microsoft Fabric Mirroring, preserving ownership boundaries and meeting data governance requirements with near real-time analytics.
• Stop Scaling Azure SQL: Find Real Performance Issues
  Azure offers built-in diagnostic tools to pinpoint genuine performance issues in SQL databases, recommending optimization before scaling up.
• Migrate a .bak to Azure SQL Database primary‑key violation (SQL Error 2627)
  The migration failed due to SSMS creating a default case-insensitive collation in the target Azure SQL database, causing primary-key violations (SQL Error 2627); resolve by pre-creating the DB with the source’s case-sensitive collation or using SqlPackage from an Azure VM.
• The SSMS extension ecosystem is growing up: list, acquire and maintain extensions with ease
  The SSMS Extension Manager now lets users easily discover, acquire, and maintain third-party extensions through a curated list, centralized gallery, and automated update notifications.
• Smarter Storage for Azure HorizonDB
  Azure HorizonDB's smart storage layer offloads durability and high availability tasks from PostgreSQL, reducing CPU, disk, and network load.
• Move to Modern SQL Server Licensing with Confidence
  Transitioning to Modern SQL Server PAYG licensing reduces administrative overhead and aligns costs with actual usage, ideal for growing workloads.

🛠️ Developer tools

• Agent Package Manager for AI Azure Engineering
  The Agent Package Manager for AI on Azure provides a standardized, auditable way to declare and manage AI agent dependencies, MCP servers, and governance policies in cloud engineering workflows.
• You can just find and use agent skills mid-session
  The article demonstrates how to dynamically discover and load agent skills during coding sessions, reducing token usage and context confusion by only activating necessary skills when needed.
• Custom Agents in Microsoft Agent Framework for .NET: building a chat with custom instructions
  The article shows how to create a personalized AI agent using the Microsoft Agent Framework for .NET, including custom names, instructions, and improved conversation through refined system prompts.
• Using multiline Parameters for Aspire and ASP.NET Core with user secrets and Azure default deployments
  This article shows how to use base64 encoding to bypass Aspire's multiline parameter limit, allowing proper PEM file setup for certificate configurations in ASP.NET Core and Azure.
• Today I will… review GitHub PRs
  The article shows how Visual Studio integrates with GitHub to streamline pull request reviews, featuring inline commenting, C# syntax highlighting, and Copilot for collaboration.
• Github Specify
  GitHub Specify bundles a CLI tool and Spec Kit templates to convert structured specifications into reusable artifacts like constitution.md, spec.md, plan.md, and tasks.md, facilitating collaboration among product teams, engineers, AI coding agents, and CI pipelines while streamlining the product-to-code process.
• Microsoft AI Roundup MCP Server
  The new MCP server for the Microsoft AI Roundup newsletter enables direct querying of its content using tools like Claude Desktop and Cursor, expanding accessibility for users.
• Getting started with RAG in ASP.NET Core
  ASP.NET Core developers can simulate RAG workflows using simple keyword matching instead of complex vector databases to understand the core retrieval, augmentation, and generation cycle.
• Stop alt-tabbing into the wrong Visual Studio
  Visual Studio now allows each open solution to have its own color theme via a new settings experience, improving visual distinction between projects without needing restarts or extra dialogs.
• How we make AI coding more cost efficient without sacrificing task quality
  GitHub Copilot enhanced AI coding efficiency by prioritizing relevant context over token reduction, leading to quicker task completion and reduced costs via improvements such as maintaining useful context, eliminating unnecessary formatting, shortening instructions, and removing redundant tasks.
• VS Code 1.136 Pushes Agents Deeper Into the Development Workflow
  VS Code 1.136 introduces Agent Merge and multi-root sessions, enabling AI agents to handle pull request completion, orchestration, and review alongside code generation.
• Nodes & Edges in Microsoft Agent Framework
  The framework models workflows as directed graphs with Executors performing deterministic tasks and Edges defining typed message routing, enhancing separation of concerns, reusability, predictability, and testability.
• New stuff in Critter Stack AI Skills 1.10
  Critter Stack AI Skills 1.10 adds eleven new skills raising the total to 102 with improvements for tool usage, code writing, understanding failures, and utilizing observability features for better troubleshooting and best practices.
• GitHub Copilot app for Beginners: Run several agents at once
  The GitHub Copilot app lets beginners run multiple AI agent sessions simultaneously, each operating in its own Git worktree and context, enabling parallel development tasks without interference.
• Build a Local RAG Application in C# with Ollama and Qdrant – Part 3
  This third part refactors a C# RAG application using Microsoft.Extensions.AI and VectorData to simplify provider specifics, facilitating easier model or database swaps while maintaining full control over retrieval-augmented generation.
• Why does a MAUI app store data under “User Name” on Windows?
  In MAUI Windows apps, local storage defaults to a directory named "User Name" based on the PublisherDisplayName setting, reflecting the app’s display name rather than the user's username.
• Ground your GitHub Copilot agent in a local clone instead of letting it guess
  Using a local GitHub Agentic Workflows clone allows Copilot to access precise implementation details, improving reliability in matching documentation with actual code over model memory or general web searches.
• Project HydraFusion: Frontier quality via multi-model orchestration
  Project HydraFusion automates model selection and orchestration for complex tasks, balancing performance, cost, and latency without developer intervention.

🔩 DevOps

• Automate Terraform with Azure DevOps
  Automate Terraform deployments on Azure using DevOps pipelines, enabling multi-environment management, secure remote state storage, and automated approvals with built-in drift detection.
• The deployment succeeded, but I deployed the wrong agent
  The issue arose from deploying agents from an outdated Git revision, leading to generic identities instead of defined roles, underscoring the need to verify deployment sources.
• Enterprise Live Migrations is now in public preview
  Enterprise Live Migrations enables moving Azure DevOps repositories to GitHub Enterprise Cloud with minimal downtime under 30 minutes.
• Pondering Continuous Integration in our new AI World Order
  The article discusses how rapid advancements in AI-assisted coding are straining traditional continuous integration (CI) processes, leading developers like Jeremy Miller to reconsider CI workflows by adopting trunk-based development, selective local testing, and more aggressive flaky test elimination to mitigate slowdowns caused by overloaded GitHub Actions.
• Ditch the Token Headache...SSH Just Works!
  Switching from password to SSH authentication for GitHub deployments simplifies access management and eliminates token-related overhead while maintaining strong security practices.
• Introducing Radius Canvas: visualize, review and deploy applications in the GitHub Copilot app
  Radius Canvas integrates into GitHub Copilot to let developers and AI agents visualize, review, and deploy cloud-native apps with a shared, updated model of services, dependencies, and infrastructure across environments.
• AI Just Joined Your Code Reviews: GitHub Copilot Comes to Azure Repos
  GitHub Copilot’s preview for Azure Repos automates early feedback on correctness, security, and maintainability in pull requests while keeping human reviewers in control of approvals.
• Can one agent start another? Queueing sub-tasks in GitHub Agentic Workflows
  GitHub’s new Agentic Workflows allow agents to queue sub-tasks such as planning, coding, reviewing, securing, and deploying code without human intervention, but they are limited by the platform’s accountability model that requires a user-to-server token for actions like starting cloud agent sessions.
• A trust checklist for GitHub Actions
  The trust checklist for GitHub Actions outlines critical signals such as tooling maintenance, runtime hygiene, release integrity, and governance to evaluate safe usage in CI workflows.

🧬 Hybrid + multicloud

• Public Preview: Azure Multicloud Interconnect
  Azure Multicloud Interconnect’s public preview offers secure, private connections from Azure to AWS, enabling seamless hybrid workloads across clouds.
• Speaking at the Hybrid Platform Conference 2026 in Amsterdam
  I'll be discussing Azure Local, hybrid cloud strategies, and AI integration at the free Hybrid Platform Conference 2026 in Amsterdam on September 28.
• Generally Available: Certificate Management for Azure Arc-enabled Kubernetes
  The new Azure Arc-enabled Kubernetes Certificate Management extension automates TLS certificate issuance, renewal, and distribution across edge clusters, reducing operational complexity with production support and broad platform compatibility.
• How Microsoft’s Physical Security Engineering Team scaled hybrid operations with Azure Arc and Azure Virtual Desktop
  Microsoft's team unified hybrid operations using Azure Arc and Azure Virtual Desktop for consistent management, automation, and visibility across global infrastructure supporting cloud and AI services.

🎭 Identity

• How to sync user accounts from Entra ID to Active Directory
  Entra Cloud Sync automates synchronization of user accounts between Azure Entra ID and on-premises Active Directory, simplifying identity management in hybrid setups.
• Entra Global Secure Access (GSA) Client Intune Deployment PowerShell Script
  The provided PowerShell script automates Entra GSA client deployment via Intune, including logging setup and IPv4 preference configuration for seamless integration.
• Missing Service Principals in Entra ID: Why Conditional Access, App Protection and Global Secure Access will fail + more fun
  Omitting service principals in Azure Entra ID can cause Conditional Access, App Protection, and Global Secure Access policies to malfunction, potentially creating security vulnerabilities.
• What’s new in Microsoft Entra: September 2026
  The September 2026 Entra update introduces tenant governance, user-centric access reviews, workflow cloning, and a passwordless identity model for Teams devices.
• Not Only Azure: Migrating this Blog from Entra ID to Standard OIDC
  Moonglade migrated its blog from Entra ID-specific auth to standard OpenID Connect, streamlining the system by treating Entra ID as just one of many OIDC providers.
• Entra Private Network Connector Session Persistence
  The Entra Private Network Connector introduces session persistence to enhance reliability for internal resource access.

🔌 Integration

• BizTalk Server 2020 End-of-Sale Announcement
  BizTalk Server 2020 sales will end on March 31, 2027, with mainstream support until April 12, 2028, and optional extended support until April 10, 2030, encouraging customers to migrate to Azure Logic Apps Standard or Hybrid.
• Build governed asynchronous APIs with Azure API Management and Azure Service Bus
  Azure API Management now natively integrates with Azure Service Bus enabling secure publishing of HTTP requests as messages via a send-service-bus-message policy without additional middleware.
• Azure API Center: Govern APIs with Spectral linting
  Integrating Azure API Center with Spectral enables organizations to automatically enforce governance standards and catch API vulnerabilities early, using either a managed service or self-hosted Azure Function for linting OpenAPI and AsyncAPI definitions.
• APIM Policy Patterns for AI Governance: Part 2 – Content Safety & Model Control
  Part 2 of the series focuses on runtime controls for AI governance, detailing how to implement content safety and model access policies within API management systems.
• Introducing APIOps CLI
  APIOps CLI lets teams manage Azure API Management config as source-controlled code, enhancing versioning, review, deployment, and integration with GitOps workflows for better governance and scalability.
• AI Gateway tier of Azure API Management — August 2026 updates
  The August 2026 update to Azure API Management’s AI Gateway tier adds richer OpenTelemetry observability for AI workloads and new model cost monitoring with budget enforcement features.
• Azure Service Bus: Migrate topology one event at a time
  Azure Service Bus allows gradual migration of messaging topologies by running old and new delivery paths simultaneously, enabling one event stream to be updated at a time with minimal risk of message loss.
• Azure Logic Apps Standard | Keep WEBSITE_CONTENTSHARE Unique
  Azure Logic Apps Standard auto-generates a WEBSITE_CONTENTSHARE except when using secured storage accounts in virtual networks or needing distinct share names for multiple apps, requiring manual assignment.
• Simplifying code-first integrations with Azure Connector Namespace
  Azure Connector Namespace simplifies code-first integrations by allowing Function Apps to use pre-built Logic Apps connectors via a .NET SDK, reducing authentication, polling, pagination, retry, throttling, and error-handling complexities.
• Logic App Storage Inspector
  Logic App Storage Inspector provides Azure Logic App Standard users with a read-only Kudu site extension to search, compare, and view workflow data dashboards for tables, queues, and health indicators without altering storage.
• Exploring Azure Management APIs with az rest and az resource
  Azure CLI commands replace the retired resources.azure.com website by enabling raw HTTP requests and simplified resource queries directly from the terminal.

🎓 Learning and Certifications

• Joseph Guadagno: Architecture for AI Development - Episode 417
  Joseph Guadagno, a 30-year experienced software architect and 2007 Microsoft MVP, discusses AI development architecture in this episode following his 2021 focus on Azure DevOps.
• AI-901 Speech Recognition and Synthesis: Convert Between Audio and Text
  AI-901 covers Azure Speech’s speech recognition (audio→text) and synthesis (text→audio) capabilities, essential for tasks like transcribing calls or reading alerts aloud in the exam.
• AI-901 Text Analysis Techniques: Keyword Extraction, Entity Detection, Sentiment, and Summarization
  The AI-901 exam distinguishes between keyword extraction, entity detection, sentiment analysis, and summarization for different scenario needs.

⚖️ Management and Governance

• Generally Available: Azure Monitor Auxiliary Logs Plan support for Azure tables and plan switching
  Azure Monitor now offers GA support for storing auxiliary log data in Azure tables, allowing efficient retention of large non-query logs at lower costs and includes a new plan switching feature for easier management.
• Generally Available: Azure Monitor Auxiliary Logs Plan in Azure Government and China regions
  Azure Monitor launched a General Availability of Auxiliary Logs Plan in Azure Government and China regions to provide cost-effective high-volume log ingestion and retention for compliance and auditing.
• Generally Available: Azure Copilot Observability Agent supports Basic and Auxiliary table plans
  The Azure Copilot Observability Agent now supports Log Analytics data in Basic and Auxiliary table plans, allowing teams to analyze and investigate high-volume telemetry interactively at no extra cost.
• Interim guidance for Morocco DST change 2026
  Microsoft will release an update on September 20, 2026, to support Morocco’s DST change, adjusting clocks back by one hour from UTC+1 to UTC+0, with interim guidance suggesting users temporarily set their devices to Coordinated Universal Time.
• From GPO to Microsoft Intune: A practical guide to cloud-first policy management
  This guide outlines three strategic paths for organizations: starting fresh with cloud-native devices, migrating necessary settings from GPOs to Intune, and coordinating both tools for hybrid Entra-joined devices, emphasizing the need to assess existing policies to retain essential security baselines and operational requirements.
• Build Azure Landing Zones That Prevent Cloud Sprawl
  The Azure IaC accelerator aids organizations in creating governed landing zones with enforced hierarchy, design standards, and automation to integrate policy, security, and networking and curb cloud sprawl.
• Close the gaps: layered data protection with Microsoft Purview across endpoint, browser, and network
  Microsoft Purview's layered data protection approach offers specialized safeguards across endpoints, browsers, and networks to reduce leakage risks while maintaining high performance.
• Hitzefrei for On-Call: Azure SRE Agent Takes the Shift
  The Azure SRE Agent automates many on-call tasks, integrates with existing monitoring tools, and costs $49 per agent per month.
• Announcing the resiliency agent in Azure Copilot, now in public preview
  The Azure Copilot resiliency agent offers actionable recommendations and deployment-ready code for zonal resiliency in one conversation, transforming continuous assessment into ongoing improvement.
• Monitoring Harbor with Azure Monitor and Azure Managed Grafana
  Azure Monitor and Managed Grafana together enable real-time tracking of Harbor 2.15 performance metrics, automating data ingestion and visualizing key insights through customizable dashboards.
• Automating Compliance Scope Enforcement with Azure Policy
  Automating Compliance Scope Enforcement with Azure Policy outlines a five-step process to ensure only C5-certified Azure services are deployed by blocking non-certified resources automatically.
• Keep the evidence: Low-cost logs with Azure Copilot Observability Agent (Generally Available)
  The Azure Copilot Observability Agent enables low-cost log investigation by querying Basic and Auxiliary table plans, providing contextual evidence alongside alerts, metrics, and resource changes during incidents.
• Build Advanced ServiceNow Response Plans in Azure SRE Agent
  Azure SRE Agent’s advanced filters let teams precisely scope response plans to specific ServiceNow incidents, such as routing high-priority production network issues owned by the Network group to designated specialists with required approvals.
• Role Assignments | Role Based Access Control Administrator
  Ensuring the deployment service principal has necessary permissions to create role assignments is crucial when using Azure IaC for resources like Key Vault or storage accounts.

🚌 Migration

• Release Announcement of SQL Server Migration Assistant (SSMA) v10.6
  SSMA v10.6 generalizes Copilot-assisted Sybase code conversion, enhances Managed Endpoint authentication with production-ready features, expands Azure OpenAI model support, and fixes DMS authentication issues from duplicate subscription names.

🌐 Networking

• Generally Available: Azure Firewall auto-learn SNAT routes
  Azure Firewall's new auto-learn SNAT routes feature discovers registered and private destination prefixes, converting them into No-SNAT rules to preserve original source IPs and simplify SNAT setup.
• Generally Available: Azure Virtual Network Manager IPAM in additional Azure regions
  Azure Virtual Network Manager’s IP address management service is now generally available in key sovereign and international regions, simplifying IP resource governance across multi-region deployments.
• Public Preview: Azure Front Door profile and route level WAF policies
  Azure Front Door introduces public preview of WAF policies that can be set at both the overall profile and individual route levels, enhancing security flexibility for large-scale deployments.
• Introducing Azure Multicloud Interconnect for AWS
  Azure Multicloud Interconnect provides simplified private connectivity between Azure and AWS via standardized Open APIs, ensuring high performance, security, and ease of management for AI-driven multi-cloud workloads.
• Azure Firewall explicit proxy is now generally available
  Azure Firewall's new explicit proxy feature allows users to direct specific apps or browsers' HTTP and HTTPS traffic through the firewall, streamlining policy enforcement and decreasing dependence on external proxies.
• Your Private Endpoint Does Not Cover Agent Egress: Locking Down Azure AI Foundry in Both Directions
  Azure AI Foundry's private endpoint secures only inbound traffic; agents can still reach out to tool endpoints from public IPs unless network injection is configured separately.
• What’s new in Azure Firewall: Recent innovations
  Azure Firewall now offers explicit proxy, IPv6 support, and HTTP header insertion for enhanced managed forwarding, transition ease, and centralized policy enforcement.

🔐 Security

• Generally Available: Microsoft Defender for Cloud support for Azure Container Apps (Serverless Containers Posture)
  Customers can now integrate Azure Container Apps environments with Microsoft Defender for Cloud’s Serverless Containers Posture for unified security management.
• One SOC, Many Tenants: Centralizing Microsoft Sentinel with Azure Lighthouse
  Azure Lighthouse allows a central security operations center to monitor multiple Entra ID tenants by granting delegated read access to each tenant's Log Analytics workspace while maintaining data residency and lowering compliance risks.
• What’s new in Microsoft Sentinel: August 2026
  Microsoft Sentinel launches an AI-powered playbook generator to speed up incident response, enhances UEBA with broader anomaly insights, expands Codeless Connector Framework with nested API support, and supports multi-account ingestion from Auth0, CrowdStrike, and Salesforce.
• Introducing Multi-Account Support for Connectors in Microsoft Sentinel
  Microsoft Sentinel now allows single connector configurations to monitor multiple Auth0 tenants, CrowdStrike Falcon accounts, and Salesforce Service Cloud orgs, simplifying security visibility without custom scripts or duplicate setups.
• MDATP Linux agent latest release reporting
  The MDATP Linux agent automates reporting of Defender for Endpoint packages across distributions in an Excel workbook, handling failures smoothly.
• Stop identity attacks before they start with Microsoft ISPM recommendations
  Microsoft's ISPM focuses on critical identity vulnerabilities such as unauthorized SaaS app accounts, overly privileged service accounts, and non-admin users with password-reset rights for sensitive groups, offering prioritized mitigation guidance.
• Counterfeit installers to system compromise: Tracking a deceptive software download campaign
  The campaign employs counterfeit Razer download sites with changing hosts and hash-generated installers to target various sectors in China.
• Azure Key Vault Control Plane API Update: Required Upgrade for Azure CLI and Azure PowerShell Users
  Upgrade Azure CLI to version 2.90.0 or later and Az PowerShell's Az.KeyVault module to 6.7.0 or higher before February 27, 2027, to continue using Key Vault control-plane management operations after the older API versions are retired.
• 358 - What’s up, Exposure Management?
  Microsoft Security Exposure Management now includes containment capabilities for AI agents and integrates several features under MSEM, enhancing its ability to protect against sophisticated threats.
• From AI Infrastructure to Secure AI Agent Infrastructure with kars
  ByteCraft AI's Forge agent, despite its rapid issue resolution capabilities, showed vulnerabilities under hostile instructions, necessitating a secure architecture that isolates untrusted content processing from credentials and authority definitions.
• ASCII smuggling crosses over from AI prompt injection to phishing evasion
  Researchers discovered attackers using ASCII smuggling to evade email filters by embedding financial lure words with invisible Unicode tags.
• How to secure edge AI in customer-owned environments
  Securing edge AI involves verifying runtimes, artifacts, and using deterministic mediation to prevent prompt injection, tampering, and malicious firmware updates.

📦 Storage

• Public Preview: Per-disk resiliency for Azure VMs
  Azure introduces per-disk resiliency for virtual machines, automatically restarting a VM when it loses access to an attached managed disk without any user intervention.
• Scaling AI Storage: Azure Managed Lustre excels in MLPerf Storage v3.0
  Azure Managed Lustre significantly outperforms other hyperscalers in MLPerf Storage v3.0 with 642.2 GiB/s write throughput and sustained hundreds of GiB/s across a 25 PiB file system for training tasks.
• Accelerated AI & Analytics workload on Azure Blob Storage: Up to 25x faster List Blobs operations
  Azure Blob Storage's new in-preview List Blobs optimization can increase operation speed up to 25 times and cut client CPU usage by 15 times through Apache Arrow format.

💻 Virtual Desktop Infrastructure

• Microsoft Azure Virtual Desktop Hybrid is now generally available
  Azure Virtual Desktop Hybrid extends on-premises VDI to the cloud via Azure Arc for seamless management and user experience without full migration.
• Windows 365: Five Years In, See What's New
  Windows 365 integrates AI agents like Microsoft Scout for tasks such as file management, document editing, and email drafting within Cloud PCs, accessible via Teams on any device, boosting productivity and ensuring security through input/output protection.
• Windows 365 Cloud PC for Developers – Developer Configuration Image + PowerShell Provisioning
  The Windows 365 Developer Configuration image streamlines setup by preinstalling essential development tools, reducing onboarding time for developers, though it remains in public preview with limitations on third-party applications.
• Azure Virtual Desktop Hybrid Join without VPN: A Deep Dive into the New Azure Arc-Based Architecture
  Azure Virtual Desktop now supports hybrid joining without VPN via Azure Arc allowing session hosts in on-premises or edge locations to connect directly to Azure Virtual Desktop using Entra ID authentication.