Azure Weekly

Issue 584

18^th October 2026

The big announcements this week were focused on hardware - Azure Maia 300 SoC and The Surface Laptop Ultra. I have a Surface Laptop Studio 2, which needs replacing and I was holding out for the Ultra, but I'm going to wait for a few more real-world reviews before committing to an eye-watering price tag! Of all the Spark RTX Laptop review videos I've seen so far, Alex Ziskind's has been the most interesting.

This week's highlights include:

• Deep dive into Azure Maia 300 architecture by Rani Borkar, Saurabh Dighe - Azure Maia 300 optimizes LLM inference with a system-wide approach, integrating software, silicon, rack infrastructure, and datacenters to deliver high performance per watt for agentic workloads.
• Building an AI-ready workspace around Surface Laptop Ultra by Hannah Todd - The Surface Laptop Ultra, equipped with powerful hardware and compatible Accessories like the ViewSonic ColorPro monitor and Kensington VeriMark fingerprint security key, forms an AI-ready workspace boosting creativity, collaboration, and secure authentication.
• Hybrid intelligence makes the device part of enterprise AI architecture by Robert Henry - Hybrid intelligence combines local device and cloud AI, necessitating IT leaders to determine workload placement for sensitivity and latency while overseeing security and resource management.
• From Chat to Decisions: Bringing SLMs into Application Logic with Microsoft Olive and ONNX by Kinfey Lo - Microsoft Olive and ONNX allow small language models to translate semantic understanding into structured decisions for streamlined workflows without removing necessary rule-based constraints.
• Advancing hardware security with open-source Integrated HSM technology by Mark Russinovich, Saurabh Dighe - Project Tessera, an open-source initiative by Microsoft, Marvell®, Oracle, and the Open Compute Project, expands Azure Integrated HSM capabilities to provide fully open hardware security module specifications, drivers, software, firmware, and build environments for broader industry collaboration and silicon implementation.
• Azure Verified Modules (AVM) is now owned by Azure engineering by Jack Tracey - Azure Verified Modules has shifted from community ownership to Azure engineering control, enhancing resources while preserving open-source status with a new three-tier model beginning in 2027.

Finally, Gregor Suttie has created a very useful app which he talks about in: Azure VM Price Increases: A Small App to Show What Your Estate Will Actually Cost - The Azure VM price increases affect small applications by potentially doubling estimated costs, highlighting the importance of precise cost modeling.

🤖 AI

• Microsoft-Decision-1 available in Microsoft Foundry
  Microsoft-Decision-1 in Foundry provides efficient yes/no checks, classifications, and scaling at low cost, perfect for agent guardrails and automated workflows.
• Not Every Decision Needs an LLM: Getting Started with Microsoft-Decision-1
  Microsoft-Decision-1 is a lightweight model for fast, accurate decisions with structured outputs via API, outperforming rivals in speed and accuracy.
• Building Permission-Aware Hosted Agents for SharePoint in Foundry Agent Service
  Foundry Agent Service uses identity passthrough to ensure SharePoint retrieval respects individual user permissions without requiring custom infrastructure or data movement.
• Governance Boundaries in Microsoft Foundry
  Understanding how to separate Azure subscription/resource group policies from Foundry's project, model deployment, and agent endpoint controls is crucial for effective production management.
• Microsoft Foundry Guardrails Getting in Your Way? Here’s How to Dial Them Down
  Microsoft Foundry users can bypass false positives by creating custom guardrails and switching the intervention action from Block to Annotate.
• Inference Options on Azure: An Architect’s View
  This guide compares six Azure inference options highlighting their capabilities, supported model types, and unique features.
• Which Reflection Model Should Power your Agent Optimizer?
  The study shows no single reflection model consistently outperforms others across four agent workloads; GPT-5.6 Sol excelled in Facility, GPT-5 topped Taxman, Retail Policy saw strong results from GPT-5 mini and GPT-5, while GPT-5.6 Terra led GSM8K, emphasizing the need for task-specific model selection.
• GPT-chat-latest gets more intelligent, interactive, and personal in Microsoft Foundry
  GPT-chat-latest in Microsoft Foundry now supports GenUI for interactive charts and interleaved-thinking output, enhancing usefulness with partial answers while improving intelligence across coding, search, multilingual interactions, personalization, and task creation.
• From Chat to Decisions: Bringing SLMs into Application Logic with Microsoft Olive and ONNX
  Microsoft Olive and ONNX allow small language models to translate semantic understanding into structured decisions for streamlined workflows without removing necessary rule-based constraints.
• Building an AI-ready workspace around Surface Laptop Ultra
  The Surface Laptop Ultra, equipped with powerful hardware and compatible Accessories like the ViewSonic ColorPro monitor and Kensington VeriMark fingerprint security key, forms an AI-ready workspace boosting creativity, collaboration, and secure authentication.
• Muse Spark Open is available in Microsoft Foundry Models
  Muse Spark Open, Meta's coding-optimized open-weight model now in Microsoft Foundry Models, excels at analyzing large codebases, reliable tool integration, and sustained progress across complex development tasks with a 1 M-token context window.
• Hybrid intelligence makes the device part of enterprise AI architecture
  Hybrid intelligence combines local device and cloud AI, necessitating IT leaders to determine workload placement for sensitivity and latency while overseeing security and resource management.
• Copilot Studio | The Workflow That Runs Every Time
  Copilot Studio’s new hooks feature lets agents run custom workflows on every lifecycle event, enabling deterministic rules like context injection or auditing without altering tool logic.
• Information Extraction with Low-Inference-Cost Models: 85% F1 Gain via Foundry Interactive Training
  Fine-tuning low-cost GPT-OSS models can boost information extraction F1 scores by up to 85%, matching top models like GPT-5.6-sol while reducing Azure inference costs.
• Managing open-weight model risk in enterprise deployments
  Microsoft and NVIDIA introduce a shared risk taxonomy and framework to help enterprises assess and manage risks associated with deploying open-weight AI models, emphasizing that model openness alone does not dictate risk levels and requiring consideration of use case, architecture, and surrounding controls.
• Build a Tenant-Wide Microsoft Foundry Model Operations Dashboard
  The dashboard unifies Azure OpenAI deployments across subscriptions and teams, offering real-time insights into model ownership, usage metrics, token consumption trends, quota risks, and cost allocations without collecting sensitive user data.
• Web IQ: Web Search and Grounding APIs for AI Agents
  Microsoft Web IQ provides AI-native web-search and grounding APIs for LLMs and AI agents, improving reasoning capabilities with Azure-hosted token efficiency and scalability.
• Five Web IQ use cases: bring the outside world into your AI agent
  Web IQ enhances AI agents by integrating real-time web intelligence for use cases like market research, customer service, shopping assistance, and regulatory compliance.

🔎 Analytics

• Public Preview: Azure Databricks Private network gateway
  Azure Databricks’ new private network gateway in public preview lets serverless workloads securely access virtual networks and transitively connected networks via a single managed connection.
• Official icon sources for Microsoft Fabric architecture diagrams
  Microsoft Fabric architecture diagrams now have a centralized resource for official icons, including support for Azure DevOps, Git, and GitHub integrations.
• FabCon Europe 2026: What Fabric IQ, Foundry and Agents Mean for Data Engineers
  FabCon Europe 2026 highlights how Fabric IQ centralizes semantic models to resolve data inconsistencies, making AI agents more reliable by ensuring consistent business concepts across sources.
• FinOps for Data and AI Workloads
  FinOps for data and AI workloads focuses on measuring cost per reliable outcome, accurate resource tagging, policy-based demand matching (e.g., auto-termination for Azure Databricks), and right-sizing shared capacity with controlled experiments to protect performance.
• Fabric and Databricks Together
  Fabric optimizes governed analytical experiences with OneLake, Power BI, and T-SQL marts, while Azure Databricks excels in engineering and ML execution with Spark, Unity Catalog, and feature pipelines-use each based on workload responsibility to avoid duplication.
• Fabric Data Agents: A Production Readiness Guide for Enterprise Teams
  The guide details the release process for Fabric data agents in enterprises, focusing on metric accuracy, access compliance, reproducibility, and differentiating GA core features from preview integrations such as Foundry orchestration.
• More expressive graph analysis: GQL improvements in Microsoft Fabric Graph
  The GQL enhancements in Microsoft Fabric Graph for January-August 2026 introduce ANY SHORTEST for explicit shortest path selection, quantified edge patterns for repeatable relationships with conditions, and various path modes (WALK, TRAIL, SIMPLE, ACYCLIC, DIFFERENT EDGES) to control traversal constraints, enabling more precise graph analysis.
• Explore deeper connections with unbounded variable-length paths in Microsoft Fabric Graph
  Microsoft Fabric Graph now supports unbounded variable-length paths, allowing graph queries to follow relationship depths based on the data structure instead of fixed hop limits, improving analysis for complex, dynamically connected datasets.
• How Do You Know Your AI Agent Is Working?
  Databricks integrates AI agent evaluation with data governance tools to manage assessment artifacts as sensitive data without needing extra platforms or security clearances.

🖥️ Compute

• Advancing AI fleet reliability through industry collaboration
  Through the Open Compute Project, tech companies develop AI infrastructure standards to reduce complexity and enable AI-assisted fleet management.
• 90 DAYS LEFT: Windows Server 2016 End of Life January 2027 – Plan Your AD CS Migration Now
  Windows Server 2016 ends support on January 2027, so admins should migrate AD CS soon to prevent disruptions.
• Deep dive into Azure Maia 300 architecture
  Azure Maia 300 optimizes LLM inference with a system-wide approach, integrating software, silicon, rack infrastructure, and datacenters to deliver high performance per watt for agentic workloads.
• Microsoft Bets on Its Own Chips with New Maia 300 for AI
  Microsoft's new Maia 300 chip aims to deliver high-performance AI processing with improved energy efficiency and lower operational costs compared to previous models.
• Qwen3.8-Flash-Next on two H100s in an Azure Spot VM
  Running Qwen3.8-Flash-Next on two H100 GPUs in an Azure Spot VM achieves about 200 tokens per second with sub-second first token latency due to efficient cache usage and a special serving flag optimizing performance for mixture-of-experts models.
• Understanding device redirection changes in Hyper-V Virtual Machine Connection enhanced session mode
  The October 2026 Hyper-V update shows sensitive device redirection options upfront in enhanced session mode, defaulting to not sharing printers, smart cards, and WebAuthn credentials with VMs for better security.
• Microsoft's AI Power Play: Maia, MAI, and NVIDIA
  Microsoft is integrating its custom AI chips, proprietary models, and NVIDIA’s ecosystem to enhance Azure’s AI capabilities and improve large-scale inference efficiency.
• Powering Azure infrastructure from grid to chip
  Microsoft is redesigning its power delivery system to efficiently support high-density AI workloads by introducing 800-volt DC infrastructure and modular rack designs.
• Infrastructure for the frontier era: Scaling intelligence through open industry collaboration
  Microsoft is developing a unified frontier infrastructure-combining AI accelerators like Azure Maia 300 for inference efficiency and agent-native CPUs such as Cobalt 200-to support complex agentic workloads, enhancing collaboration between human expertise and technology across sectors.
• Azure VM Price Increases: A Small App to Show What Your Estate Will Actually Cost
  The Azure VM price increases affect small applications by potentially doubling estimated costs, highlighting the importance of precise cost modeling.
• HA-Ready SAP HANA Disaster Recovery: a 2+2 setup across Azure Region with SAPHanaSR-angi
  The 2+2 HA-Ready SAP HANA Disaster Recovery setup across Azure Regions uses two-node active clusters for primary availability and passive clusters for DR, with asynchronous replication ensuring local production continuity after a regional failover.
• Generally Available: Automatic Zone Balance for Virtual Machine Scale Sets
  Automatic zone balance for Virtual Machine Scale Sets continuously redistributes VM instances across availability zones in Azure, reducing the impact of single-zone failures.

🚢 Containers

• Making the AKS Control Plane Less of a Black Box with Managed Prometheus
  Azure Managed Prometheus provides granular visibility into API server and etcd performance via pre-built Grafana dashboards.
• Build a Simple GPU-Enabled Kubernetes Cluster on Azure N-Series VMs
  This Azure N-Series GPU-enabled Kubernetes cluster lets platform and ML engineers run direct, low-latency GPU development workloads with a two-node kubeadm setup, ideal for debugging PyTorch services in a shared sandbox environment.
• Evolving the cloud-native foundation for the next generation of AI
  Evolving the cloud-native foundation for AI needs adaptable infrastructure integrating compute, storage, and networking with open technologies for flexibility and simplicity.

🗄️ Databases

• Episode 192 - What is new at SQLCon 2026 Barcelona
  At SQLCon 2026 in Barcelona, Microsoft announced enhancements to Azure SQL Database, featuring local time zone support and improved performance for the Business Critical tier.
• From alerts to answers: The future of PostgreSQL operations is intelligent
  AI-powered PostgreSQL agents on Azure will help developers quickly diagnose issues by providing context-rich insights and recommendations, bridging the gap between raw alerts and actionable answers.
• From Alert to Online Repack: Playbook for PostgreSQL Table Bloat on Azure Database for PostgreSQL
  The playbook explains how to detect and reclaim PostgreSQL table bloat on Azure Database for PostgreSQL using a monitoring job with pg_cron, then repackage online via pg_repack, focusing on update- or delete-heavy tables that grow physically without apparent row count changes.
• Re-Seeding a Broken Log Shipping Secondary (Without Touching the Primary)
  SQL Server log shipping recovery avoids primary server disruption by manually restoring the backup chain on the secondary and manually updating msdb pointers to bypass common GUI-related failures.
• Introducing sqlsimtools
  sqlsimtools is a free, open-source suite that lets developers simulate concurrent workloads on SQL Server 2019-2025, Azure SQL Database, Managed Instance, and Fabric across Windows, Linux, and macOS, with tools for configuring, running, monitoring, and comparing performance.
• mssql-python 1.16.0: Python 3.15 support, Conda, and faster fetches
  mssql-python 1.16.0 adds Python 3.15 support, prebuilt Conda packages for Windows Linux macOS (including ARM64), a read-only row._mapping view to simplify mapping rows to dictionaries, and an optional Rust-based mssql-odbc provider that boosts performance in bulk operations.
• September 2026 Recap: Azure Database for PostgreSQL
  Azure Database for PostgreSQL now offers cross-tenant Customer Managed Key support, allowing ISVs to host resources with customers controlling encryption keys in Azure Key Vault or HSM, and previews Database Hub for unified monitoring and security across multiple databases.
• Migrating Azure Cosmos DB Across Regions
  Migrating Azure Cosmos DB across regions involves selecting among three patterns that balance data movement time, application downtime, and goals such as simplicity, minimal outage, or high availability.
• Azure SQL Performance Troubleshooting: When High Latency Is Not High CPU
  Azure SQL performance issues can stem from waits like PAGELATCH (in-memory contention) or ASYNC_NETWORK_IO (client consumption delays), even when CPU, IO, and worker resources appear healthy.
• sqlpackage can now skip Windows users and other Azure incompatible objects when exporting a .bacpac
  sqlpackage 170.6.28-preview adds properties to automatically exclude Windows users and Azure incompatible objects in .bacpac exports, streamlining development for SQL Server databases.
• What Really Happens When You Scale Azure SQL Database? How to Monitor Long-Running Scale Operations
  Azure SQL Database scaling involves provisioning a new instance, optionally replicating data, switching traffic, and cleaning up the old environment, causing varying scaling durations.

🛠️ Developer tools

• Building a Local RAG Copilot with Foundry Local: Evidence Before Answers
  The project shows how separating policy evidence from case facts and using Foundry Local allows an on-device RAG copilot to offer traceable citations and indicate when evidence is insufficient.
• Delivering Agent Skills Over MCP
  The Skills extension for Model Context Protocol standardizes agent access to shared skills from a central server, reducing duplication and ensuring consistency in updates.
• GitHub Copilot app for Beginners: How to teach Copilot about your codebase
  GitHub Copilot's customization options enhance its accuracy and efficiency by tailoring it to specific codebases, repeatable procedures, specialized tasks, and external tools.
• Trick or Tokens: Five Monsters Eating Your Context Window
  RTK reduces token consumption by 13% by filtering redundant shell output, while clearing sessions and compacting context prevents performance degradation in AI coding agents.
• 10 MCP servers you need to install now as a .NET developer
  These 10 MCP servers enhance .NET development by allowing Claude and AI coding assistants to access real data, query, manage repositories, monitor deployments, test browsers, and lookup documentation, streamlining workflows.
• VS Code 1.141 Brings Copilot, Codex Sessions Together, Tightens AI Agent Security
  VS Code 1.141 integrates GitHub Copilot and OpenAI Codex sessions, enhancing multi-app AI conversation continuity while introducing cross-platform sandboxing for improved security.
• Part 7: Securing an MCP Server with Microsoft Entra ID
  Securing an MCP Server with Microsoft Entra ID adds OAuth authentication, ensuring only authorized clients like VS Code or a .NET agent can invoke sensitive tools such as approve_expense_report, enhancing security before the server receives a public URL.
• Teaching Claude Code to Knock: Beethoven, Shostakovich, and a 30-Line Hook
  The author created a personalized doorbell system using Claude Code, with Beethoven's Fifth Symphony playing on a Mac and Shostakovich’s DSCH on a Windows laptop to indicate code refactor status.
• Fine-Tuning and Auditing an On-Device SLM Traffic Controller with Real London Data
  Ebenezer Isaac Veeraraju fine-tuned a large language model on a consumer GPU using Foundry Local to simulate London traffic signals, reducing delays by 8.8% and matching MaxPressure's performance while ensuring tamper-evident logging for UK compliance.
• .NET 11 RC2 Adds Post-Quantum Crypto, .NET MAUI C# UI and NuGet Controls
  .NET 11 RC2 introduces post-quantum cryptographic APIs, enhances .NET MAUI for cross-platform C# UIs, and integrates NuGet control packages to streamline dependency management.
• Triaging Dependabot With a Copilot Canvas
  The Dependabot Triage Canvas visualizes GitHub's dependency pull requests with grouping options, highlights security alerts without merged PRs, shows overlapping updates to streamline merges, and allows approval or merging of PRs directly within Copilot.
• Part 8: Deploying an MCP Server to Azure Container Apps
  Deploying an MCP Server to Azure Container Apps enables stateless scaling without session affinity, simplifying deployment while adding a notification tool that sends emails when reports are approved.
• Stop waiting on a failed build
  Visual Studio 2026 version 18.11 adds an opt-in feature that stops a solution build instantly upon the first project failure, cutting wait time from around 26 seconds to less than two seconds while still failing the overall build.
• Send GitHub Copilot CLI telemetry to Azure Application Insights
  The author configured an OpenTelemetry Collector in Azure Container Apps to send GitHub Copilot CLI telemetry data to Azure Application Insights for analysis using KQL.
• VS Code 1.142 Brings AI Canvases, Tighter Agent Controls and a New Model Picker
  VS Code 1.142 introduces AI canvases for visual collaboration, enhanced agent session management, and a model picker to give developers and enterprises greater control over coding assistants.
• The next developer interface is ambient intelligence
  The next developer interface will use ambient intelligence with AI agents that understand repositories, plan, and execute tasks based on developer-defined boundaries, focusing on expressing intent rather than issuing commands.
• GIT dubious ownership when using NAS without domain
  Git's new safe.directory protection causes VS Code to report "no repository" when accessing NAS shares on Windows due to ownership mismatches; add exact path entries for each repository in Git's global config as a solution.
• SQL developer tools at SQL Modernization Day
  SQL developers can now perform extensive database tasks directly in VS Code with the MSSQL extension's new features, including backup/restore, real-time query profiling, and AI-assisted schema design.
• Bounded Local Agentic Patterns for Clinical RAG
  Bounded Local Agentic Patterns for Clinical RAG introduces a Rust Rocket server limiting agent authority to fixed dispatch paths for predictable execution and regulatory compliance in health-record systems.
• Microsoft Agent Framework: Human in the Loop Tool Approval with .NET
  The Microsoft Agent Framework introduces a .NET-based "Human in the Loop" approval process, allowing agents to pause and seek human consent before executing potentially undesirable actions.
• From Local RAG to an AI Agent in C# with Ollama and Qdrant – Part 2
  This part expands an AI agent built with C#, Ollama, and Qdrant to include tools for checking deployment status and retrieving application errors, enabling it to handle multi-turn conversations and investigate issues using multiple data sources.

🔩 DevOps

• Why your agents need infrastructure vending
  Infrastructure vending automates AI agent interactions with software and cloud resources, minimizing risks through codified rules and pipelines.
• Azure Verified Modules (AVM) is now owned by Azure engineering
  Azure Verified Modules has shifted from community ownership to Azure engineering control, enhancing resources while preserving open-source status with a new three-tier model beginning in 2027.
• October Patches for Azure DevOps Server
  These October patches for Azure DevOps Server address critical security vulnerabilities and improve performance, with the latest version supporting up to 10,000 concurrent users.
• From 2,500 requests to 24: Rebuilding star history without the stargazers
  GitHub redesigned its star history endpoint to return daily star counts for up to 30 weeks in one request, removing user identities, easing database load, and resolving privacy and performance issues.
• GitHub availability report: September 2026
  GitHub improved capacity in September 2026 by reducing database pressure, adding overload controls, and moving workloads to Azure, despite challenges such as uneven regional deployment and a database failover.
• From .sqlproj to production: generate a well documented Azure DevOps pipeline for your SQL Database Project
  The new SQL Project Power Tools command creates a comprehensive Azure DevOps pipeline for SQL Database Projects, including documentation and checklists on authentication, firewall setup, review processes, drift management, tooling versions, project styles, and environment configurations.
• Keep the creepy crawlies out of you workflows: securing GitHub Actions in 2026
  GitHub has introduced new security protections for GitHub Actions following recent supply chain attacks, such as setting the GITHUB_TOKEN to read-only by default and adding OpenID Connect for cloud deployments, urging users to immediately secure their workflows.

🧬 Hybrid + multicloud

• Adding granular control: Windows Admin Center for Azure Arc-enabled Servers is now GA!
  Windows Admin Center for Azure Arc-enabled Servers provides granular, secure, and cloud-native management of hybrid infrastructure directly from the Azure portal without needing VPNs or public IPs.
• Microsoft named a Leader in the 2026 Gartner® Magic Quadrant™ for Server Virtualization Platforms
  Microsoft is recognized as a Leader in the 2026 Gartner® Magic Quadrant™ for Server Virtualization Platforms due to its operational and infrastructure consistency via Azure Arc and Hyper-V across various environments.
• End of Lifecycle for Windows Server 2012 and 2012 R2
  The end of life for Windows Server 2012 and 2012 R2 on October 13, 2026 means organizations must plan migrations to supported systems to maintain security and compliance.

🎭 Identity

• Attackers Follow the Path You Designed – Why Identity Architecture Matters More Than Ever
  Weak identity security architecture provides attackers a route through organizations, emphasizing the need for controls like least privilege, just-in-time access, and continuous governance to reduce privilege escalation risks.
• What’s new in Microsoft Entra: October 2026
  Microsoft Entra enhances adaptive access, strengthens workload trust via token binding, and simplifies identity management for humans and AI agents.
• Identity at Every Hop
  Identity at Every Hop guides managing delegated and managed identities for each component in a Teams request flow to ensure proper token scoping and prevent relay attacks from disrupting audience enforcement and conditional access policies.
• How to speed up PIM activations in Microsoft Entra ID
  Speed up PIM activations in Azure AD by optimizing role assignments, reducing SaaS provisioning delays, and regularly refreshing tokens.
• Attackers Follow the Path You Designed – Why Identity Architecture Matters More Than Ever?
  Weak identity architecture creates predictable attack paths, emphasizing the need for least privilege, just-in-time access, and continuous governance to secure privileged identities.
• Microsoft Entra expands who can create agent blueprints
  Starting in November 2026, default users in Microsoft Entra will gain the ability to create agent blueprints, with options to restrict access and manage app-only permissions for enhanced security.
• Manage individual Security Defaults protections in Microsoft Entra
  Microsoft Entra now offers individual control over Security Defaults protections, expanding multi-factor authentication coverage and integrating with Conditional Access for enhanced security.
• What are Conditional Access Plans?
  Conditional Access Plans in Azure Entra let admins organize and apply security policies based on shared conditions, starting disabled by default for granular access control.

🔌 Integration

• Power Apps | The Page That Reports Itself
  Power Apps now automatically sends generative page telemetry to Azure Application Insights without any code, covering page loads, crashes, and data calls in real time.
• ACP, Agents and the Move Toward Capability-Level Governance
  Power Platform governance is shifting from controlling connectors to managing capabilities, crucial with the rise of Copilot Studio agents and MCP-connected tools, focusing on business purpose and least privilege.
• Power Automate: Streamline Invoice Approvals in Teams
  Power Automate automates invoice approval workflows within Teams, ensuring seamless document storage in SharePoint and maintaining a comprehensive audit trail.
• APIM to Logic Apps Error – Note for self
  The author resolved an APIM policy error by correctly formatting C# code within @{ } braces to ensure Logic Apps received a properly serialized JSON payload instead of raw code text.

🎓 Learning and Certifications

• Lab 15 - Secure PaaS Administration Capstone
  This lab covers covering App Service, managed identities, Private Link, RBAC and private DNS troubleshooting, staging readiness, release promotion and rollback.
• Lab 16 - Resilient IaaS Operations and Recovery
  This hands-on lab uses a two-VM application behind Azure Load Balancer to investigate three separate incidents: an incorrect health-probe port, an NSG rule blocking client traffic while probes remain healthy, and a missing file recovered from Azure Backup without rebuilding the original VMs.
• M365 Con 27 - The Microsoft Community Convention: 11th - 22nd January 2027
  M365Con 2027 is a free, community-run online conference. Azure sessions include "Bicep vs. Terraform Showdown" (Maik van der Gaag), "Getting started with Sovereign Landing Zones on Azure" (David Pazdera) and "Azure Landing Zones Without the Overwhelm" (Florian Lenz).
• Postgres Trip Report from Postgres Summit US 2026
  Postgres Summit US 2026 included sessions on performance, replication, AI integration, developer tools, and community sustainability by the Microsoft team.
• Checklist for the GH-300 GitHub Copilot exam
  The checklist covers essential topics like code generation, debugging assistance, and integration with popular IDEs to help you pass the GH-300 GitHub Copilot certification exam.
• New Tools, New Workflows and the Value of the Visual Studio Subscription: What We Learned at VSLive! San Diego
  VSLive! San Diego showed experienced developers using AI alongside hands-on learning, emphasizing how the Visual Studio Subscription supports this changing developer path.
• AZ-800 vs. AZ-802: Avoid the Wrong Windows Server Exam
  AZ-802 replaces the retired AZ-800 exam as the primary requirement for Windows Server certification, shifting the focus toward modern hybrid infrastructure management.
• Picking the Right AI Model for AI-901: Four Questions That Save Time and Money
  This video series guides you in selecting the right AI model for the AI-901 exam by addressing job requirements, model type, deployment location and cost, and desired behavior to enhance performance, accuracy, and affordability.
• How EQ Bank connects AI learning, innovation, and governance
  EQ Bank’s framework connects role-based learning, practical application, peer support, and governance to promote responsible AI innovation while satisfying regulatory needs in financial services.
• New Microsoft Certified: Agentic DevOps Engineer Expert
  The new certification validates skills in integrating AI assistance into CI, CD, and monitoring processes using Azure DevOps and GitHub.
• New GitHub Certified: Agentic AI Business Professional
  The new GitHub Certified: Agentic AI Business Professional certification validates business professionals' skills in using GitHub and GitHub Copilot to design agentic workflows with human oversight, targeting product managers, program managers, technical project managers, and business analysts without requiring deep coding experience.
• New Microsoft Certified: Supply Chain Management AI Consultant Associate
  The new Microsoft Certified: Supply Chain Management AI Consultant Associate certification validates AI implementation skills in Dynamics 365 Supply Chain Management through Exam AB-330, currently offered in beta at an 80% discount for the first 300 registrants.
• Master Microsoft Entra with live webinars, AMAs, and on-demand videos
  Mastering Microsoft Entra involves live webinars, AMAs, and on-demand videos that provide real-time expert insights into Zero Trust adoption, AI automation, and hybrid security strategies.

⚖️ Management and Governance

• Troubleshoot Missing AI Prompts in Purview Activity Explorer
  Purview may omit AI prompt details due to misconfigured audit settings, capture policies, or insufficient viewer permissions; verify these configurations in a scoped test environment.
• Stop Copilot Web Searches from Leaking Sensitive Data
  Use Azure Purview’s Data Loss Prevention rules to prevent Copilot from transmitting confidential information during web searches and verify compliance through the audit log.
• Understand your Azure backup estate, from protection flow to reviewed change
  Azure Support Agent's Backup Manager helps reliability teams quickly identify which parts of their backup chain need attention by integrating protection flow data with policy details, vault status, failure investigations, and cost context for informed decision-making.
• Bring Azure SRE Agent into your developer workflow with the new canvas
  The new Azure SRE Agent canvas integrates with GitHub Copilot for enhanced incident investigation and informed decision-making.
• Enterprise Adoption Guide for Azure SRE Agent, Part 1: Deploying Your First Azure SRE Agent
  The guide outlines practical steps for enterprises to adopt Azure SRE Agent by addressing a clear operational pain point, leveraging built-in features initially, and gradually expanding its use.
• Enterprise Adoption Guide for Azure SRE Agent, Part 2: From One Team to Enterprise-Wide Adoption
  This guide details expanding Azure SRE Agent adoption across an enterprise through role-based access control, guardrails for shared agents, and deployment governance strategies.
• Getting started with Azure SRE agent and some success stories
  Azure SRE Agent integrates with Azure services such as Monitor and Log Analytics, utilizing Anthropic or OpenAI models for AI inference under Microsoft's supervision, with applications ranging from troubleshooting diagnostics to AIOps management.

🚌 Migration

• Generally Available: Azure Site Recovery Support for Azure ARC-enabled Windows VMWare/Physical servers
  Azure Site Recovery now supports disaster recovery for Azure ARC-enabled Windows VMware VMs and on-premises physical servers, enabling protection with ASR while preserving Azure ARC's management and inventory features.

🌐 Networking

• Generally Available: Standard service endpoint
  Azure’s new Standard service endpoint in Private Link offers a scalable, secure way to connect IaaS workloads to PaaS services, overcoming previous manageability and scalability limitations.
• Networking for the AI era: Building for scale, efficiency, and openness
  Networking must evolve beyond raw speed to enhance AI productivity and resilience in scaled distributed environments, as shown by Microsoft’s MRC specification.

🔐 Security

• Hunting Password Spray in Sentinel: One Password Against a Thousand Doors
  Password spray slips under smart lockout and builds the hunt in Microsoft Sentinel step by step, ending with the query that catches a spray followed by a successful sign-in.
• Generally Available: Azure Cloud HSM hardware audit logging
  Azure Cloud HSM now offers hardware-generated audit logs for all supported management operations, enhancing security monitoring, compliance reporting, and forensic capabilities.
• Generally Available: External key management for Azure Key Vault Managed HSM
  Azure Key Vault Managed HSM’s external key management feature allows customers to maintain physical control of key-encryption keys for compliance-driven workloads across all public Azure regions.
• Strengthening Semiconductor Supply Chain Trust with Microsoft’s Artifact Signing and Transparency
  AMD and Microsoft collaborate on applying artifact signing and transparency technologies to enhance semiconductor supply chain provenance and strengthen trust in hardware for sensitive workloads.
• What Supermarkets Cybersecurity Can Learn From Battlestar Galactica
  The supermarket cyberattack underscores the need to isolate critical systems such as refrigeration controllers from unpatched networks, similar to Galactica's strategy that thwarted Cylon infiltration.
• Advancing hardware security through open-source collaboration
  Tessera Integrated HSM boosts key protection against AI attacks and quantum threats with improved interoperability and performance via its workload-attached architecture.
• Advancing hardware security with open-source Integrated HSM technology
  Project Tessera, an open-source initiative by Microsoft, Marvell®, Oracle, and the Open Compute Project, expands Azure Integrated HSM capabilities to provide fully open hardware security module specifications, drivers, software, firmware, and build environments for broader industry collaboration and silicon implementation.
• Hands-On: Seculyze for Microsoft Sentinel – Part 1: Calibrate Your Detection Posture
  Seculyze for Microsoft Sentinel helps security teams quickly calibrate detection rules using real-world threat data, improving incident response accuracy and reducing false positives by up to 30%.
• Secure Linux desktops with Microsoft Defender
  Microsoft Defender expands enterprise security to Linux desktops with enhanced protection, detection, vulnerability management, and response for developer workstations.
• Threat Modeling Azure MCP: Securing AI-Assisted Infrastructure Operations
  Azure MCP Server allows AI assistants to securely interact with Azure services for tasks such as troubleshooting, but demands rigorous identity management, role-based access control, and precise scope definitions to avoid exposing sensitive data or enabling unauthorized changes.
• Troubleshoot Hyper-V guarded fabrics and shielded VMs
  This FAQ addresses common issues with Hyper-V guarded fabrics and shielded VMs, providing step-by-step solutions for platform failures, missing features, misconfigurations, hardware incompatibilities, and driver conflicts, stressing proper troubleshooting over risky fixes.

📦 Storage

• Public Preview: Azure Files cross-region data copy and synchronization with Azure Storage Mover
  Azure Storage Mover offers a public preview for seamless cross-region copying and synchronization of Azure Files data with support for scheduled incremental transfers for disaster recovery and geo-replication.

🔗 Web

• Deno’s endo – team joins CloudFlare, runtime will be abandoned in one year’s time
  Deno's creator Ryan Dahl announces the team will join Cloudflare, with the runtime set for abandonment after one year due to competition from Bun and advancements in Node.js TypeScript support.
• What Traffic Engineering Taught Us About Building an Azure App
  Building an Azure conference app with traffic engineering ensures smooth navigation between sponsor tables for meaningful interactions while efficiently directing requests to various services through clear signage.