Azure Weekly

Issue 585

25^th October 2026

Not many official announcements this week - a few in Management & Governance, and Networking (I suspect many announcements a will be made at Microsoft Ignite in November). Highlights this edition include:

• Implementing Next Best Action (NBA) in Foundry with Microsoft-Decision-1 by Olivier B. - Implementing NBA in Foundry with the new Microsoft-Decision-1 model shows that ranking deals solely by size is insufficient; considering context such as contact restrictions and buyer intent is crucial for determining effective next steps for sales reps.
• Advancing digital sovereignty with greater control and choice by Douglas Phillips - Microsoft’s Sovereign Cloud initiative provides flexibility in controlling from public cloud to private environments and partner ecosystems, allowing organizations to customize sovereignty for specific workloads while ensuring consistent governance.
• Azure OpenAI in the EU Data Zone: residency is guaranteed, capacity is not by Kaspars Jurjāns - Azure OpenAI EU Data Zone deployments keep processing inside the EU but don't guarantee quota; what one team hit when moving a SharePoint assistant to EU-only processing, plus a checklist for EU-only AI rollouts.
• Built by experience: The journey to Azure Linux 4.0 by Poorvi Narang - Azure Linux 4.0 integrates cloud-scale workload expertise into a versatile general-purpose server distribution for Azure VMs and AKS, maintaining alignment with Fedora's package system while defining specific Azure-focused enhancements.
• Enhanced Feature Flags: A New Foundation for Feature Management in Azure App Configuration by Mukta Batra - Azure App Configuration introduces enhanced feature flags with dedicated resources, distinct security, and tailored APIs for independent management.

🤖 AI

• Hardening On-Premises RAG: Identity, Admission, Readiness, and PHI-Safe Observability
  Hardening on-premises RAG systems requires identifying implemented code controls, limitations, and necessary blockers for privacy, security, and compliance without using cloud endpoints.
• Copilot Studio | The Skill That Isn't There
  Copilot Studio silently skips skills that fail load-time checks without notification, prompting developers to implement preflight validation before sharing skills in the new marketplace preview.
• Now in Foundry: Meta Muse Spark Open, NVIDIA Nemotron 3.5 Super VL, and Reflection Beam
  The new Meta Muse Spark Open model offers 1M-token context for multimodal reasoning and coding, NVIDIA's Nemotron 3.5 Super VL excels at vision-language tasks with up to 1M native tokens, and Reflection Beam provides high-efficiency retrieval-augmented generation for enterprise applications.
• Web IQ: Web Search and Grounding APIs for AI Agents
  Microsoft Web IQ offers AI agents real-time web intelligence via an AI-native API suite that retrieves structures and provides scalable, citable context on the public web through a fully hosted, Azure-billed solution.
• Five Web IQ use cases: bring the outside world into your AI agent
  Web IQ enhances AI agents by integrating real-time web intelligence for use cases like market research, customer service, shopping assistance, and regulatory compliance.
• Microsoft Foundry Update Brings Scheduled AI Agents, Smarter Tool Use and GPT-6 Models
  The update introduces scheduled AI agents for automated workflows, enhanced tool usage intelligence, and the new GPT-6 models for improved performance and local development options.
• Transforming Enterprise Documents into AI Knowledge with Agentic RAG
  Microsoft Foundry and ASP.NET Core provide three distinct architectural paths for enterprise RAG, ranging from simple file search to complex federated knowledge retrieval.
• Introducing the customer conversation harness in Microsoft Copilot Studio
  The new customer conversation harness in Microsoft Copilot Studio enables seamless omnichannel interactions, team collaboration, and integration with third-party contact centers.
• What’s New in Cowork: Expanded plugins and role-based skills
  Cowork offers role-based plugins for Sales, Service, Education, and Legal teams, automating workflows with integrated prebuilt skills.
• Cohere Rerank V5 is now available in Microsoft Foundry
  Cohere Rerank V5 in Microsoft Foundry boosts AI response relevance via enhanced document ranking, multilingual enterprise support, and a Context Focus feature that extracts key passages for better efficiency.
• Open-Weight Models in Microsoft Foundry
  In Microsoft Foundry, select open-weight models by considering deployment paths, licensing, data processing locations, support models, safety controls, and operational ownership for alignment with workload requirements and organizational policies.
• Azure Content Understanding
  Azure Content Understanding introduces structured fields, layout-aware text extraction, confidence scoring, source grounding, and multimodal support for docs, images, audio, and video to enable automated analytics, retrieval-augmented generation, and agentic applications.
• Building a Self-Updating RAG System: Handling Document Uploads, Updates and Deletions
  RAG systems require a unified lifecycle architecture using Cosmos DB and Service Bus to ensure that document updates and deletions propagate correctly to search indexes.
• Implementing Next Best Action (NBA) in Foundry with Microsoft-Decision-1
  Implementing NBA in Foundry with the new Microsoft-Decision-1 model shows that ranking deals solely by size is insufficient; considering context such as contact restrictions and buyer intent is crucial for determining effective next steps for sales reps.
• Adapting Biological Monitoring for Food Security with Agents
  Microsoft Discovery uses agentic workflows to repurpose biological monitoring systems from tracking human pathogens to identifying agricultural crop pests.
• Foundry Fine-Tuning: open-source model expansion, MAI-Code, and shared multi-LoRA deployments
  Foundry now offers four open-source fine-tuned models including Muse-Glimmer-30B, qwen3.8-27b, qwen3.6-35b-a3b, and gpt-oss-120b, along with the new MAI-Code-1.1-Flash for coding tasks and Multi-LoRA deployments to reduce costs.
• Customer Conversation harness – a new way to build customer-facing agents in Copilot Studio
  The Customer Conversation harness in Copilot Studio enables single agents to handle both voice and chat interactions, combining deterministic topic skills with generative AI sub-agents for flexible, scalable customer support.
• Azure OpenAI Decisions API: Now generally available in Microsoft Foundry
  The Azure OpenAI Decisions API is now generally available in Microsoft Foundry, enabling AI applications to make fast, efficient decisions with low latency.
• Azure OpenAI in the EU Data Zone: residency is guaranteed, capacity is not
  Azure OpenAI EU Data Zone deployments keep processing inside the EU but don't guarantee quota; what one team hit when moving a SharePoint assistant to EU-only processing, plus a checklist for EU-only AI rollouts.
• Copilot, SharePoint and 400,000 construction documents: four checks before you trust an AI answer
  Four checks: document version, approval status, citation location and user permissions — for verifying answers from AI assistants that search SharePoint document libraries.

🔎 Analytics

• Brian Hitney on Fabric Apps
  Brian Hitney explains how Fabric Apps enable seamless integration of custom applications with Azure Fabric’s data services, leveraging built-in security and scalability features.
• Microsoft Foundry, Azure Databricks, or Microsoft Fabric?
  Choose Azure Databricks for large-scale data and ML workloads, use Fabric for unified analytics and Power BI reporting, and opt for Foundry when building cross-system AI agents.
• Lift and shift vs modernizing your data warehouse
  Choosing between lift-and-shift or modernizing a data warehouse involves weighing faster, lower-cost migration against long-term benefits like improved performance and reduced technical debt.
• Simplify private connectivity for Azure Databricks Serverless with Private Network Gateway
  The Private Network Gateway simplifies connecting Azure Databricks Serverless workloads to on-premises and virtual network resources with a single managed connection, reducing complexity while maintaining access control.

🖥️ Compute

• CPU vs. GPU vs. TPU vs. NPU: Meet the Processors Powering AI
  CPUs manage general application logic and coordination, while GPUs leverage parallel processing to handle the massive mathematical workloads required for modern AI training and inference.
• Strengthening Confidential VM Migrations with Large OS Disk Encryption
  Large OS Disk Encryption for Azure Confidential VMs now supports operating system disks over 127 GB, facilitating enterprise migration of sensitive workloads with preserved confidential encryption and customer-managed keys.
• Choosing the Right Azure Virtual Machine for Ansys CFX
  Choosing the right Azure Virtual Machine for Ansys CFX involves balancing performance and cost, with the latest HBv5 VM offering significant speed improvements and cost efficiency on larger meshes compared to 176-core HBv4 options.
• Who Really Restarted Windows Server? Event ID 1074 and 6008
  Get-WinEvent filters extract the specific user account, process, and shutdown reason from Event IDs 1074 and 6008 to identify the exact cause of server restarts.

🚢 Containers

• Making ACR Data Transfer Visible: The Storage Activity Platform Behind GetBlob Metrics
  Azure Container Registry introduces a Data Transfer metric to show outbound data amounts, and a new Storage Activity Platform quickly tracks GetBlob traffic within minutes.
• Resolve Kubernetes CoreDNS Timeouts Like a Pro
  This guide explains CoreDNS timeout issues in Kubernetes by analyzing five DNS resolution stages ndots lookups, conntrack timing, cache configuration, and NodeLocal DNSCache for efficient diagnosis and resolution.
• Data Transfer and Transactions metrics now generally available for Azure Container Registry
  Azure Container Registry now provides GA Data Transfer and Transactions metrics for analyzing outbound traffic, API operations, regions, and request outcomes without extra setup or expense.
• GPU Memory Profiling on AKS: Find the Code Behind Memory Pressure
  GPU memory profiling on AKS identifies memory-allocation functions in AI workloads to optimize resources and prevent out-of-memory errors without altering code or restarting pods.
• Built by experience: The journey to Azure Linux 4.0
  Azure Linux 4.0 integrates cloud-scale workload expertise into a versatile general-purpose server distribution for Azure VMs and AKS, maintaining alignment with Fedora's package system while defining specific Azure-focused enhancements.
• Dapr v1.19 is now available
  Dapr 1.19 adds actor placement improvements, new Binary Store and search/vector APIs, enhanced workflow event handling, cross-app workflow capabilities, and better Kafka transaction support across various components and SDKs.
• Making Azure Container Registry Activity Visible at Scale
  Azure Container Registry now publishes Transactions and Data Transfer metrics at scale, enabling detailed visibility into registry operations, regions served, and data movement for each geo-replica.

🗄️ Databases

• Generally Available: Azure Cosmos DB Safe Key Rotation
  Azure Cosmos DB's new Safe Key Rotation feature tracks timestamps for each account key access, facilitating safer and more efficient credential rotation with minimal disruption.
• The SQL Advisor: Seven Answers, All Measured
  The SQL Advisor finds that setting the compatibility level to 170 in SQL Server 2025 significantly reduces I/O when using table variables versus temp tables, illustrating optimizer impact on query performance.
• SQL Server Performance Office Hours Episode 91
  In Episode 91, Erik Darling addresses audience questions on SQL Server performance, including hash distribution, memory grants, Query Store, and resolving query timeouts without blocking.
• The Invisible Storage Leak: How Replication Slots Can Fill Azure PostgreSQL Flexible Server Storage
  Azure PostgreSQL Flexible Server users must monitor replication slots to prevent unexpected storage growth and potential overage costs caused by retained WAL files in lagging or problematic replicas.
• Make Estate yours: Focus on the databases and issues you own in Database Hub
  Database Hub in Microsoft Fabric's public preview enables creation of custom views for owned databases and issues, simplifying triage and collaboration across Azure SQL Database, PostgreSQL, and Azure Cosmos DB.
• Managed Instance link with failover groups (limited preview)
  The preview will let customers replicate data from SQL Server to a managed instance within a failover group, combining hybrid replication with geo-redundancy in Azure, enabling near real-time cross-region data sync and bidirectional disaster recovery.
• SQL Server on Azure VMs makes history with the first audited SQL Server TPC-H result in the cloud!
  SQL Server 2025 on Azure F64amds_v7 VM achieved an audited TPC-H result of 1,667,428 QphH@1000GB, marking the first official cloud-based SQL Server TPC-H benchmark demonstrating enterprise-grade performance and durability in the cloud.
• Using PostgreSQL to reflect on its own history and code: introducing pghacker-mcp.dev
  pghacker-mcp.dev converts PostgreSQL's extensive mailing list messages and commit data into a searchable knowledge graph for AI agents to better understand the database's design history.
• Wolters Kluwer scales tax and accounting software with PostgreSQL on Azure
  Wolters Kluwer selected Azure Database for PostgreSQL’s elastic clusters to scale its expanding 10 TB dataset, retain managed service advantages, and comply with German data residency regulations.
• Modern Query Editor for Azure SQL Database is now generally available
  The modern Query Editor for Azure SQL Database introduces a multi-tab workspace, interactive results, improved Object Explorer search, data preview tabs, and simplified result management to enhance efficiency in daily database tasks within the Azure portal.
• The Perils of Secondary Metrics in SQL Server
  The video explains why common secondary metrics like page life expectancy in SQL Server often mislead analysts and recommends focusing on primary performance indicators instead.
• Public Preview: Alerts for Azure SQL Database in Database Hub, powered by Fabric Activator
  The public preview introduces alerts powered by Fabric Activator in Azure SQL Database’s Database Hub, enabling automatic notifications and automated responses without additional monitoring infrastructure.
• Managing security with Database Hub in Fabric: From signals to action
  Database Hub in Microsoft Fabric's public preview provides a unified platform for assessing security posture across various cloud databases, identifying key issues, and directing prioritized actions with comprehensive visibility.

🛠️ Developer tools

• Beyond One-Size-Fits-All: Decision Routing for GitHub Copilot in CLI & VS Code
  Decision-ghc-router enables GitHub Copilot CLI and VS Code extensions to select the optimal, efficient model for tasks, enhancing performance while maintaining the current developer workflow.
• Manage skills and plugins across Claude Code, Codex and GitHub Copilot with APM
  The Microsoft Agent Package Manager (APM) enables unified management of skills and plugins across Claude Code, Codex, and GitHub Copilot using a shared manifest and global lockfile.
• Organize and revisit tabs with the keyboard
  Visual Studio 2026 version 18.11 introduces keyboard shortcuts to move and jump between open tabs by their visual order, enhancing navigation efficiency without using a mouse.
• Introducing Scope: Open-source evaluation for AI coding agents
  Scope is an open-source platform that transforms AI coding agent interactions into data for improving Developer Agent Experience (DevAx), enabling product teams to address issues in documentation, SDKs, and tooling through real agent behavior insights.
• How to continue a GitHub Copilot app session in VS Code
  You can continue a GitHub Copilot app session directly in Visual Studio Code, preserving all changes, context, and state for review and local testing.
• Part 9: Connecting an MCP Server to Microsoft Foundry Agent Service
  Connecting an MCP Server to Microsoft Foundry Agent Service adds Azure-hosted authentication by using a toolbox to publish an MCP endpoint, allowing Claude and other agents to interact securely without local identities, while keeping the original MCP server unchanged.
• Part 10: Observability, Cost Control and MCP Security
  This tenth part of the MCP Servers series focuses on observability, cost control, and security enhancements, revealing how tracing tools reveal client tool calls and data changes while uncovering a deployment bug through real-world testing.
• Building an On-Device Voice Companion with Foundry Local
  Ami is an on-device Android app using Foundry Local that transcribes and instantly responds to users' questions about wearable health data locally, without cloud processing.
• Test emails locally, mock Resend, SendGrid and SMTP with MailDotNull
  MailDotNull is an open-source local mail catcher and mock email API that accepts emails from Resend, SendGrid, Mailjet, Mailgun, Postmark, Brevo, Amazon SES, and SMTP without delivering them, allowing developers to test email flows securely using familiar SDKs.
• Azure MCP Server 3.0 Adds Cloud Operations Tools for AI Agents
  Azure MCP Server 3.0 introduces cloud operations tools for AI agents, improving backups, integrating Terraform, updating security policies, and includes breaking changes for previous users.
• Evaluate Before Production: Evidence-Based Gates for On-Premises RAG
  This prototype outlines evidence-based evaluation gates for on-premises RAG systems, requiring detailed records of revision, hardware, models, and outcomes to distinguish between demo success and production readiness.
• INFO: Get started with your individual “Azure Dev/Test credit subscription” from your Visual Studio subscription
  With every Visual Studio subscription, you receive an individual Azure Dev/Test credit subscription ranging from $50 to $150 per month, allowing independent developers and testers to explore Azure services at no extra cost.
• VS Code 1.143 Makes Copilot Default, Adds AI Model 'Bake-Off' and Local AI Without Credits
  VS Code 1.143 adds a Bake-off feature for comparing AI models locally without credits and improves tools for managing and debugging Copilot-generated code.
• Let your AI agent capture its changes with the Playwright CLI
  The Playwright CLI automates recording UI flows, capturing screenshots and videos, and presenting results in pull requests to enhance verification efficiency and help AI agents identify errors.
• HydraFusion in GitHub Copilot: My cure for model fatigue
  HydraFusion automates AI model selection and orchestration in GitHub Copilot to reduce model fatigue.
• Are You Getting Everything You Can from Your Visual Studio Subscription?
  Visual Studio subscribers gain monthly Azure credits, access to Cloud Academy and Pluralsight for certifications, Syncfusion UI components, and more benefits through the Subscriber Portal at no extra cost.
• What production taught us about reviewing AI translations
  Production experience shows that simple AI scoring metrics aren't sufficient for reviewing AI translations; instead, a combination of LLM-assisted evaluation and careful handling of source edits is needed to ensure quality.
• From podcast audio to clean subtitles in .NET: Whisper + s1-mini
  The .NET library combines Whisper’s speech-to-text with timestamped segments and s1-mini for cleaning, then writes the cleaned text back into an SRT file while preserving original timestamps.
• Microsoft Introduces 'dotnetup' Toolchain Manager for .NET SDKs and Runtimes
  The new dotnetup tool simplifies managing multiple .NET SDKs and runtimes on macOS and Linux, offering users greater control over their development environments.
• GitHub Previews Package Firewall to Block Malicious npm Dependencies
  GitHub's upcoming Package Firewall will scan and block malicious npm dependencies, enhancing enterprise security by inspecting metadata and downloads before they reach development environments.
• INFO: Discounted Azure pricing for Visual Studio Subscribers
  Visual Studio subscribers receive discounted Azure pricing, including up to 57% off services like Azure SQL Database and Windows Server VMs, with no licensing fees required for many dev/test tools.
• Creating Your Very First Custom Agent With GitHub Copilot CLI
  GitHub Copilot CLI enables developers to quickly deploy their first custom agent, streamlining AI-assisted coding workflows with minimal setup.

🔩 DevOps

• Asking the right Fabric CI/CD architecture questions
  The post outlines essential questions to ask when designing a CI/CD architecture for implementing continuous integration and delivery processes specifically for the Microsoft Fabric platform.
• How to enable GitHub Actions' immutable subject claims for OIDC and Azure
  Enabling GitHub Actions' immutable subject claims for OIDC and Azure adds Owner ID and Repository ID to the claim prefix, preventing takeover if an organization or repository is deleted, renamed, or transferred.
• Retrying Bicep Resource Deployments with the @retryOn Decorator
  The @retryOn decorator in Bicep automates retries for transient Azure deployment errors, demonstrated with a role assignment example while noting its usage limits.
• GitHub Enterprise Local: Bringing modern development to environments you control
  GitHub Enterprise Local lets organizations run a complete GitHub Enterprise Server experience on their own or Azure infrastructure, ideal for regulated sectors, remote teams, and areas with poor internet connectivity, featuring both cloud-connected Copilot and local Foundry models.
• Azure DevOps available in Microsoft Copilot
  The Azure DevOps Plugin integrates directly into Microsoft Copilot, Cowork, and Code, enabling seamless work with projects, work items, pull requests, test plans, pipelines, and more without leaving the Copilot interface, while built-in skills assist with task triage and backlog creation.
• Introducing Agentic Autofix for code and dependencies
  Agentic Autofix now uses a Copilot coding agent to tailor fixes to your repository’s standards and procedures, enhancing both vulnerability remediation and dependency updates while keeping team control over final merges.
• The bridge to agent-scale Git infrastructure
  The migration of GitHub's busiest Git repositories to Azure reduces round-trip latency from 25 ms to under one millisecond by decoupling storage from compute and serializing writes per reference, enabling high-performance development.
• Enhanced Feature Flags: A New Foundation for Feature Management in Azure App Configuration
  Azure App Configuration introduces enhanced feature flags with dedicated resources, distinct security, and tailored APIs for independent management.
• Azure DevOps Copilot Autofix Expands to Dependencies, Third-Party Security Alerts
  Azure DevOps Copilot now extends its autofix functionality to handle dependency updates and third-party security alerts, generating targeted remediation code based on repository context.
• Azure DevOps Comes to Microsoft Copilot with Plugin for Work Items Pull Requests
  The new Azure DevOps plugin for Microsoft Copilot integrates work items and pull requests directly into Copilot’s chat and code environments, streamlining developer workflows.
• Turn GitHub notifications into code with GitHub Copilot in Microsoft Teams
  GitHub's new Teams integration allows @mentioning Copilot for automatic generation of fixes, tests, and pull requests from notification threads, streamlining issue resolution.

🧬 Hybrid + multicloud

• Designing for sovereign AI: A shared foundation from edge to cloud
  Designing for sovereign AI involves integrating control across silicon, infrastructure, cloud, data, and AI layers to meet varying workload needs for sensitivity, regulation, and performance.
• Sovereign Private Cloud: Bringing more choice and control to AI and cloud infrastructure
  Microsoft's Sovereign Private Cloud initiative provides digital sovereignty by enabling organizations to run AI models locally on Azure Local infrastructure, improving data residency control, regulatory compliance, and operational flexibility.
• Advancing sovereign AI with Foundry Local and Azure Local
  Foundry Local and Azure Local provide secure, controlled environments for governments and regulated industries to run AI models with local inference, model management, GPU acceleration, and support for custom or OpenAI-compatible models, enhancing security and operational continuity.
• Introducing Azure Copilot for Azure Local: AI-powered operations for distributed infrastructure
  Azure Copilot for Azure Local enables operators to use natural language to troubleshoot infrastructure issues, providing context-aware diagnostics and recommended actions.
• Microsoft at NVIDIA GTC Berlin 2026: sovereign AI on your terms
  At NVIDIA GTC Berlin 2026, Microsoft presented sovereign AI solutions enabling organizations to dictate where their AI workloads execute, leveraging Sovereign Cloud with NVIDIA accelerated computing and open-model options through Fireworks AI on Azure.
• Scheduled backups for Azure Local with disconnected operations: Advancing control plane resilience
  Azure Local's new scheduled backup feature automates control plane recovery for disconnected operations, improving resilience.

🎭 Identity

• Announcing: Choose Your Own Telephony (CYOT) for Microsoft Entra
  Choose Your Own Telephony for Microsoft Entra allows organizations to switch SMS and voice authentication providers to any certified third party starting October 30, 2026, enhancing flexibility and security.
• Where Does My Microsoft Entra ID Data Reside? Understanding Azure Regions and Data Residency
  Understanding Azure regions and data residency for Microsoft Entra ID reveals that tenant location is based on a global identity architecture rather than the region where workloads are deployed.
• What’s New in Entra Global Secure Access Client for Windows v2.34.222
  The Entra Global Secure Access Client v2.34.222 adds a new sign-in method, improved Conditional Access policies, better diagnostics, and enhanced local network bypass for Windows users.
• Designing smarter access policies for hybrid enterprises
  Microsoft Entra Conditional Access policies secure hybrid environments by tiering application sensitivity, enforcing risk-based authentication, and assigning unique identities to AI agents.
• Entra ID Protection now flags suspicious credential additions
  Entra ID Protection alerts administrators to potentially malicious authentication method additions, enhancing user risk detection and guiding necessary tenant checks.
• How to Revoke a JWT Before It Expires
  To effectively revoke a JWT before expiration, use short-lived access tokens and revocable refresh tokens stored in a database for immediate invalidation on password changes or suspicious activity.

🔌 Integration

• Deploying Logic Apps Hybrid through an Azure DevOps pipeline
  Deploying Logic Apps Hybrid via an Azure DevOps pipeline automates infrastructure setup, on-premises connection configuration, and CI/CD processes, simplifying hybrid workflow management.
• Measuring MCP Tool Schema Overhead with Azure API Management
  Measuring full-schema and curated-tool loading with Azure API Management shows a significant reduction in token usage and AI credit consumption when exposing only essential GitHub MCP tools.
• Connect Azure Service Bus to other messaging systems with a JMS bridge
  The JMS bridge facilitates seamless integration between IBM MQ and Azure Service Bus, enabling apps to use existing brokers while accessing Azure's messaging capabilities with sub-second latency.
• 🆕Orchestrate Foundry Prompt and Hosted Agents with Logic Apps Automation
  Azure Logic Apps now supports Foundry Prompt and Hosted Agents for integrating AI-powered agents into business processes via visual workflows triggered by APIs, schedules, or external events from over 1,400 connectors.
• Power Automate: Automatically save email attachments to OneDrive.
  This Power Automate flow automatically saves incoming email attachments with specific subject filters directly to a designated OneDrive folder, streamlining document management for invoices and reports.

💡 Internet of Things

• Connecting a Teltonika ATC700 to Microsoft Fabric
  Connecting the Teltonika ATC700 mini asset tracker to Microsoft Fabric Real-Time Intelligence enables low-code integration of real-time geospatial data into IoT solutions with minimal latency.

🎓 Learning and Certifications

• New GitHub Certified: Agentic AI Business Professional
  The program certifies business professionals in designing and overseeing agentic workflows with GitHub and GitHub Copilot, aimed at product managers and analysts without extensive coding knowledge.
• Recent and upcoming Microsoft exam changes – Wednesday 21 October 2026
  Microsoft retires exams AZ-800 and AZ-801 while simultaneously updating the SC-100 certification.
• How AI Reads Text for AI-901: Four Questions That Find What Matters
  The AI-901 video series demonstrates how to use four key questions-about, who/what, feelings, and short version-to extract valuable insights from vast amounts of unstructured text data efficiently.
• Microsoft at PASS Data Community Summit 2026:
  At the PASS Data Community Summit 2026, Microsoft will showcase deep dives into Azure Data portfolio topics like SQL, PostgreSQL, and Fabric, offering AMA sessions, live Data Exposed talks, and hands-on experiences with product engineers to inspire attendees on what’s next in data innovation.
• Earning the Microsoft Frontier Transformation Engineer Badge (TITAN)
  Earning the TITAN level Frontier Transformation Engineer badge signifies mastery of AI solution design and deployment on Azure, validating expertise across certifications, projects, and governance frameworks essential for organizations adopting the Frontier Firm model.
• What’s new in AI Skills Navigator: October 2026
  AI Skills Navigator offers skilling sessions combining video content, AI-powered coaching, and knowledge checks for enhanced interactive learning tailored to various schedules and skill levels.

⚖️ Management and Governance

• Generally Available: Metrics usage insights for Azure Monitor workspace
  Metrics usage insights in Azure Monitor now provides detailed analytics on metric consumption, helping you optimize resource use and reduce unnecessary costs.
• Generally Available: Advanced platform metrics for Azure Monitor
  The new advanced platform metrics in Azure Monitor offer finer-grained data to help users rapidly detect resource changes and trends.
• Stop Copilot Summarizing Confidential Files with Purview DLP
  Purview DLP lets you create policies to prevent Copilot from processing confidential files, followed by testing to ensure no leaks occur in citations or uploaded prompts.
• General Availability: Metrics usage insights for Azure Monitor workspace
  Azure Monitor's new Metrics usage insights feature provides a comprehensive dashboard to help users visualize and optimize workspace metric consumption for improved cost efficiency.
• Calling SRE Agents for the Rescue! Are AI Agents Transforming Cloud Operations in Azure?
  Agentic Azure Insights, a quarterly community event, showcases real-world applications of AI agents in transforming cloud operations within the Azure ecosystem.
• What’s new in Azure SRE Agent: October Update
  The October Azure SRE Agent update adds enhanced security guidance, enterprise deployment resources, GitHub Copilot integration for collaboration, and plugins for connecting private Splunk environments securely.
• Fix Purview DLP Paste to Browser Blocks on AI Sites
  Purview DLP’s paste-to-browser block for AI sites can be resolved by adjusting the domain group, refining the rule condition, expanding browser coverage, and verifying changes in Activity Explorer.
• General Availability: Advanced platform metrics in Azure Monitor
  Azure Monitor now provides advanced platform metrics for Azure Storage with container-level visibility to help users quickly identify storage containers driving capacity growth or unusual consumption patterns.
• Scale Data Collection Endpoint private connectivity with IP Endpoint Compression - Preview
  Azure Monitor's new private IP endpoint compression reduces the private IP footprint by up to 95% for data collection endpoints using Private Link Scope without compromising security or operations.
• Episode 439: Azure SRE Agent vs. the Azure Copilot Troubleshooting Agent
  The podcast contrasts the free Azure Copilot Troubleshooting Agent with the paid Azure SRE Agent, highlighting differences in automation and functionality.
• Know before your customers do: a secure Azure Service Health to Slack pipeline
  The open-source pipeline securely routes Azure Service Health alerts to a single Slack message with thread updates using Entra authentication, managed Container Apps, and optimistic concurrency in Azure Table Storage for idempotent delivery without scale-to-zero overhead.

🚌 Migration

• Before Your Next Azure VM Refresh, Revisit the PaaS Options
  Before refreshing Azure VMs, reassess PaaS options such as App Service or managed databases to reduce operational overhead and maintain performance during transitions.

🌐 Networking

• Generally Available: Azure DNS enables DNS-based load balancing through Traffic Manager linked records
  Azure DNS now lets users seamlessly link DNS records to Traffic Manager profiles for automatic load balancing without additional CNAME configurations.
• Generally Available: Keyless TLS on Application Gateway with Azure Key Vault Managed HSM
  Azure Application Gateway now provides general availability for keyless TLS termination, storing certificate private keys securely in Azure Key Vault’s Managed HSM to prevent exposure during TLS handshakes.
• Generally Available: Service tag match condition for Azure Front Door Premium WAF
  The new service tag match condition in Azure Front Door Premium WAF lets security teams quickly block traffic from entire Azure services using predefined IP groupings.
• Public Preview: Disable VNet Peering Route
  The new Azure preview feature disables VNet peering routes, allowing a single summary route for all spokes to route traffic through a hub firewall and simplify security management in large hub-and-spoke networks.
• Beyond Hub-and-Spoke: Routable and Non-Advertised Azure Networks
  Azure networking now supports routable and non-advertised address spaces to efficiently manage enterprise workloads across multiple regions without exhausting IPv4 prefixes.

🔐 Security

• Agents are your newest insiders. Security must move at their speed.
  Project Perception introduces Guardian Agents and a unified cyber stack to continuously monitor, contextualize, and adapt protections for AI agents, addressing insider risk by separating intelligence supply from security authority.
• Article 4 - Governance Is the Permission Slip
  Governance should transition from a gatekeeping model to a framework defining conditions like identity management, least-privilege access, and operational visibility for safe agent adoption, fostering scalable innovation with maintained security.
• Secure Sensitive AI on Azure Confidential Computing with NVIDIA and Protopia
  Azure Confidential Computing with NVIDIA's H100 GPU and Protopia AI's Stained Glass Transform offers layered security for sensitive AI workloads in the cloud.
• What is new in Sovereign Public Cloud
  Microsoft's new Sovereign Public Cloud introduces expanded AI-focused controls, including enhanced residency options, customer-managed keys with Azure Key Vault Managed HSM, Private Link for secure transit protection, and Azure Confidential Computing to safeguard data in use.
• Fight AI with AI | Multi-Agent Security Defense
  Project Perception employs multi-agent AI to quickly emulate threat actors, identify vulnerabilities, and apply automated fixes at low token costs using the MAI Cyber Flash model in MDASH.
• Expanded cross-tenant delegated access in Microsoft Defender is generally available
  Cross-tenant delegated access in Microsoft Defender's GA governance model enables MSSPs and central security teams to manage security operations across multiple tenants with a single identity set, applying least-privilege roles via unified RBAC without requiring separate local admin accounts.
• Advancing digital sovereignty with greater control and choice
  Microsoft’s Sovereign Cloud initiative provides flexibility in controlling from public cloud to private environments and partner ecosystems, allowing organizations to customize sovereignty for specific workloads while ensuring consistent governance.
• Cloud Security Billing, Simplified: Introducing the Defender Workload Unit
  The Defender Workload Unit simplifies cloud security billing by translating diverse workload usage into a single pricing model, making cost estimation, tracking, and management more intuitive for organizations.
• Manage all your Microsoft Sentinel data in one place with Unified Data Management (Public Preview)
  Unified Data Management in Microsoft Sentinel's public preview consolidates all aspects into a single dashboard for security teams to monitor performance, troubleshoot issues, optimize costs, and maintain data consistency.
• OWASP Top 10 for Agentic Applications with Will Velida
  Will Velida and Richard discuss OWASP’s updated Top 10 security risks specific to agentic applications, including prompt injection, goal hijacking, and cascading failures across multi-agent systems.
• RateMyKeyVault: Grading Every Azure Key Vault From A to F
  RateMyKeyVault evaluates Azure Key Vault configurations, assigning grades from A to F based on security best practices and compliance metrics.
• 365 - Microsoft Digital Defense Report 2026
  The 2026 Microsoft Digital Defense Report shows a 27% rise in ransomware attacks and stresses the need for multi-factor authentication.
• Your guide to Intune at Microsoft Ignite 2026
  This guide highlights key Intune sessions from Microsoft Ignite 2026 focusing on preparing endpoint management for AI-driven security and efficiency with insights from product leaders Jason Roszak, Sangeetha Visweswaran, Alemeshet Alemu, and Rob York.
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  Storm-0940 used the AI-driven framework ARTEX to quickly compromise numerous global organizations by September 2026, gaining privileged access within hours and speeding up attacks such as the ConnectWise breach.
• Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations
  Azure WAF has introduced mitigations for PHP2Shell CVE-2026-109618 and CVE-2026-109619 to reduce exploitation risk until customers patch PHP versions, with an upcoming managed rule for improved protection.
• Patching PHP on IIS / Windows Server
  The advisory details critical remote code execution flaws in PHP on IIS/Windows Server, emphasizing immediate upgrades to patched versions for security.
• Azure WAF custom rules for PHP2Shell mitigation
  Azure WAF now provides custom rules to block PHP session uploads and limit deep form parameter nesting, mitigating PHP2Shell risks without immediate PHP upgrades.
• Secure AKS with Microsoft Defender for Containers
  Defender for Containers enhances AKS security by integrating posture, vulnerability, and runtime monitoring data to streamline defense across multiple layers when properly configured.
• Hackers Used AI to Speed Up ConnectWise Cloud Backup Attack
  Hackers employed AI agents to accelerate attacks on ConnectWise Cloud Backup and other targets globally, according to a recent report by cybersecurity experts.
• Turn threat intelligence into informed action with Microsoft Defender
  The new Threat Intelligence experience in Microsoft Defender combines external threat data, third-party sources, and internal insights to help teams prioritize and investigate threats based on industry relevance and organizational exposure.
• How bug bounty sharpens one researcher’s security skills
  @r31n's bug bounty work at GitHub shows that focusing on reproducible proofs of concept and clear security impacts can lead to elite researcher status with higher payouts and faster rewards.
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  LiteLLM 1.107.0 was compromised through Python startup hooks that automatically executed a credential collector and loader, risking exposure of various credentials across environments without explicit use.
• Protect against Brotli CVE-2026-111497 with Azure Web Application Firewall (WAF)
  Azure WAF now includes built-in protection against the Brotli CVE-2026-111497 vulnerability, automatically blocking requests with a Content-Encoding header of br for DRS 2.2 or higher, and provides a custom rule for earlier versions to mitigate the attack until applications can be patched.
• Proving a negative: auditing an Azure estate for PHP2Shell
  How Arc Theory used Claude Code with az and gh to build a read-only audit of its Azure tenants for PHP runtimes after the PHP2Shell fixes — Resource Graph queries, ACR image inspection, and why simple version checks mislead.

📦 Storage

• Generally Available: ABFS Vectored Read for Azure Data Lake Storage
  ABFS Vectored Read enhances Azure Data Lake Storage performance by merging file ranges and using asynchronous reads for faster analytics.
• Generally Available: Item Level Recovery for Azure VMs with Premium SSDv2 and Ultra Disks in Azure Backup
  Azure Backup now offers general availability of item level recovery for granular file and folder restoration on Azure VMs with Premium SSD v2 and Ultra disks, supporting both 512-byte and 4KB sector sizes.
• Optimize selective analytics reads in Azure Data Lake Storage with ABFS Vectored Read
  ABFS Vectored Read optimizes analytics reads in Azure Data Lake Storage by combining noncontiguous byte ranges into fewer asynchronous requests, lowering overhead for Parquet queries without needing query rewriting or data migration.
• Azure Storage Discovery now offers advanced capacity insights
  Azure Storage Discovery now provides advanced capacity insights analyzing data access patterns, age, tier, composition, and object size to optimize costs and identify inactive storage.

💻 Virtual Desktop Infrastructure

• NEWS: Retirement of Microsoft DevBox in Sept 2028
  The retirement of Microsoft DevBox in September 2028 phases out the service starting September 14, 2026, focusing on Windows 365 as the recommended alternative.
• Let Users Reset and Restore Their Own Cloud PCs: Windows App Settings Guide
  Windows 11 adds Live Captions to provide real-time text descriptions for audio and video, aiding users with hearing impairments.

🔗 Web

• Plan Your Java Upgrade Ahead of Microsoft’s 2027 Support Milestones
  Planning ahead for Java upgrades is crucial as September 2027 marks the earliest end-of-support date for Java 11 and 17 on Azure, prompting a transition to newer versions like 21 or 25 with tools such as GitHub Copilot’s Modernize CLI.
• From Azure Communication Services to Resend: Simplifying Moonglade Email with SMTP
  Moonglade streamlined its email system by switching from Azure Communication Services to Resend, adopting a unified SMTP approach that eliminates multiple integrations and configurations.