Azure Weekly

Issue 587

8^th November 2026

There are a few interesting AKS and container related announcements this week - possibly building up to KubeCon + CloudNativeCon North America (9th-12th November).

• Announcing flex nodes for AKS (preview) in Azure portal by Samantha Fernandez - Azure portal now offers guided creation of flex node pools for AKS, simplifying integration with user-managed virtual machines or on-premises servers while maintaining control over underlying hosts.
• Sync Without Shared Secrets: Managed Identity for ACR Connected Registry by zoeyli - Azure's Managed Identity for Connected Registry enables authentication of image sync without shared secrets via Azure RBAC and ABAC conditions, with automatic token refresh through Entra ID.
• Testing AKS Health-Aware Upgrade Gates in Preview by Richard Hooper - Azure Kubernetes Service (AKS) preview adds health-aware upgrade gates to pause automatic upgrades when instability is detected, improving reliability during maintenance.

There are also numerous announcements of new networking features and capabilities, so that section is worth reviewing this week. Two other articles which caught my attention this week:

• Why Did Our Azure Bill Change? Investigating Cloud Spend with Azure SRE Agent by Asitha De Silva - The Azure SRE Agent offers an interactive workflow linking Cost Management, Resource Graph, Advisor recommendations, and reusable skills to swiftly pinpoint cost drivers and produce customizable reports for FinOps teams.
• Inside GitHub’s new Git storage architecture by Karthik Raman, Brian Celenza - GitHub's new architecture supports thousands of concurrent agents handling up to 7,200 pushes per second with low latency reads, facilitating agentic development for hundreds of millions of developers.

And a reminder that Microsoft Ignite is happening from 17th to 20th of November. You can register for a free digital pass.

🤖 AI

• The Agentic Gatekeeper: Using Microsoft Decision-1 to Decide When Agents Act
  The Agentic Gatekeeper uses Microsoft-Decision-1 to swiftly and affordably assess AI agent actions, averting problems such as scope drift, irreversible damage, and prompt injection by outputting calibrated probabilities that result in ALLOW, ASK HUMAN, or BLOCK choices.
• From Writing Scripts to Running a Newsroom: A 24-Hour News Station with Microsoft Copilot Harness
  Meridian 24 uses the Microsoft Copilot Harness to automate a newsroom workflow, integrating editorial processes for coherent scripts before AI-generated speech synthesis, with long-running resilience protecting against production interruptions.
• Copilot Chat vs Copilot Cowork
  Copilot Chat provides secure AI chat within eligible Microsoft 365 licenses without a Copilot subscription, using only the content you provide or reference, whereas Copilot Cowork needs a license to delegate tasks such as email sending and document creation with real-time approval for sensitive actions.
• Build a Grounded Package Upgrade Advisor with Microsoft-Decision-1
  The Microsoft-Decision-1 model uses Azure Foundry and Bing Custom Search to analyze release notes and security advisories, offering automated upgrade recommendations with urgency levels.
• Introducing SharePoint tools in Work IQ
  SharePoint Tools in Work IQ bring 60+ native operations to agents via the Work IQ MCP server, boosting task success rates by 14.5% and reducing token usage while enabling real work delegation like building trackers and generating deliverables from document libraries.
• An engineering guide to Claude Code on Microsoft Foundry with Azure API Management
  This guide explains how to integrate Claude Code with Microsoft Foundry via Azure API Management for developers to access the approved model while administrators handle identity, budgeting, and private networking in a secure enterprise CCOF setup.
• Rethinking Azure OpenAI Token Economics: Processing Nasdaq Level 2 Market Data Before AI
  Azure Container Apps services pre-process raw market data to filter noise, significantly reducing token costs by sending only relevant events to the LLM for final analysis.
• 5 Ways to Stop Azure AI Agents from Blowing Your Budget
  Prevent Azure AI agent overspending by implementing API management token limits, Application Insights monitoring, semantic caching, loop restrictions, and automated budget alerts.
• Episode 440: The J Factor: Bringing Your Experience to Generative AI
  In Episode 440 of the Microsoft Cloud IT Pro Podcast, Jay Leask and Norm Young explore how personal experience influences generative AI's impact on creativity, job roles, and the future of AI-assisted work.
• Stop treating agents as one-off projects and start running them as a continuous discipline
  The IDC InfoBrief highlights that only 17% of organizations model AI cost scaling, emphasizing the need for continuous management of AI as a business discipline rather than isolated projects.
• Microsoft Foundry October Recap Separates AI Agent Previews from GA Releases
  The recap separates preview features like the Copilot harness for AI agents from fully released capabilities such as browser automation and hosted-agent improvements in October’s Foundry update.
• Moonshot AI’s Kimi K3.1 Pro comes to Microsoft Foundry
  Kimi K3.1 Pro's 1-million-token context window and multimodal features allow developers to create efficient agentic applications for handling large codebases, research documents, and integrated text-image tasks in Microsoft Foundry.
• Models Are Everywhere. Your Context Isn’t. | Microsoft IQ
  Microsoft IQ unifies Work, Fabric, Foundry, and Web intelligence for AI agents, transforming diverse data into a strategic asset that improves decision-making.
• Copilot Studio | Works on My Agent, the New "Works on My Computer"
  Sharing connected agents in Copilot Studio requires separate sharing for each agent because parent-agent permissions do not extend to child agents, impacting workflow execution and external connections.
• Improve production agents with closed-loop evaluations in Microsoft Foundry
  Closed-loop evaluations in Microsoft Foundry automatically compare new agent versions against live traffic metrics, enabling safe, data-driven upgrades without manual prompt editing or model swapping.
• Building the next generation of multimodal AI experiences with fal in Microsoft Foundry
  The partnership introduces Kling, LTX, and MiniMax video models in public preview within Microsoft Foundry, offering developers tailored options for diverse creative and engineering video generation needs.
• Direct your next shot with fal on Microsoft Foundry and ComfyUI
  Integrate the fal MiniMax H3 Max video model and Foundry image models (gpt-image, FLUX, MAI Image) into ComfyUI using custom nodes and keyless Microsoft Entra ID authentication for a cinematic image-to-video pipeline without a GPU or API keys.
• The AI-Native Enterprise: When Organizations Become Software
  The AI-native enterprise shifts focus from day-to-day management to purpose and constraints under human leadership, possibly redefining competitive advantage through organizational design.
• Web search for your agents with Microsoft Web IQ
  Microsoft Web IQ provides a standalone API for efficient web search and content grounding with low latency, integrating easily across various platforms.
• The Model Isn’t the Boss: An Azure Architecture for Accountable AI Agents
  The Model Isn’t the Boss outlines an Azure architecture separating nondeterministic AI reasoning from authoritative action and execution to ensure accountable AI agents.

🔎 Analytics

• Vector Search vs. Knowledge Graphs: Where Microsoft Fabric Graph Fits
  Microsoft Fabric Graph unifies vector search and knowledge graphs in Azure, enabling complex path analysis across connected data for applications like local government evidence labs.
• Can Fabric Copilot Run on a Separate Capacity?
  Fabric Copilot can be billed to a dedicated F2 capacity while keeping your main workspace on a separate existing capacity, allowing you to manage costs and workloads independently.
• Fabric Capacity Smoothing: Why This Morning’s Job Is Slowing This Afternoon’s Reports
  Fabric's capacity smoothing spreads background operation costs over 24 hours, potentially slowing future interactions.
• Copilot on the Power BI Report Canvas vs. Modern Report Builder
  Copilot on the Power BI report canvas creates native reports with existing tools, whereas Modern Report Builder builds custom analytical applications using Fabric Apps, focusing on agentic functionality beyond simple reporting.
• An Implementation Plan for Evaluating AI Agents on Databricks
  Databricks’ MLflow tool integrates with Databricks to evaluate AI agents on accuracy, safety, relevance, and efficiency through automated scoring, expert calibration, and continuous monitoring.
• Microsoft Fabric Connectors for reading and writing existing Microsoft Fabric data
  The new Rayfin connectors in Microsoft Fabric allow seamless data interaction, enabling a database schema to act as an interface between two applications while giving citizen developers control.

🖥️ Compute

• Windows Server October 2026 monthly security updates impact SCVMM environments
  The October 2026 Windows Server security updates cause HTTP 500 errors and UInt64 overflow exceptions in SCVMM environments, requiring specific rollbacks or hotfixes for AMD processors.
• Windows news you can use: October 2026
  October 2026 Windows update adds a new restore summary feature, improved Cloud rebuild option for PC restoration, and extended IT privileges for standard users via Intune Endpoint Privilege Management.
• Predicting and detecting failures: How Azure strengthens reliability for mission-critical workloads
  Azure's AFPD system uses machine learning to reduce VM interruptions by 36% and enable live migration for seamless workload protection.
• Designing Azure silicon on Azure silicon: EDA workloads on Cobalt 200
  Azure Cobalt 200 significantly enhances EDA workload performance boosting simulation, verification, and timing analysis speeds from 1.30x to 4.15x faster than Cobalt 100 through optimized core architecture and high memory bandwidth.

🚢 Containers

• Announcing flex nodes for AKS (preview) in Azure portal
  Azure portal now offers guided creation of flex node pools for AKS, simplifying integration with user-managed virtual machines or on-premises servers while maintaining control over underlying hosts.
• Dapr Workflow: code that picks up where it left off
  Dapr Workflow automatically resumes interrupted processes by recording each step's outcome, enabling a document extraction service to continue from the last completed task after crashes or timeouts.
• Testing AKS Health-Aware Upgrade Gates in Preview
  Azure Kubernetes Service (AKS) preview adds health-aware upgrade gates to pause automatic upgrades when instability is detected, improving reliability during maintenance.
• Implementing Traefik as an Ingress Controller on Azure Kubernetes Service (AKS)
  Implementing Traefik as an Ingress Controller on AKS involves deploying and configuring Traefik with Helm while setting up Azure Front Door Premium, Azure Private Link, and internal load balancers for private HTTPS routing.
• Sync Without Shared Secrets: Managed Identity for ACR Connected Registry
  Azure's Managed Identity for Connected Registry enables authentication of image sync without shared secrets via Azure RBAC and ABAC conditions, with automatic token refresh through Entra ID.

🗄️ Databases

• Generally Available: Restart databases in Azure SQL DB via the Azure portal
  Azure SQL Database users can now initiate database restarts or failovers directly through the Azure portal, eliminating the need for API scripting or support interactions.
• Generally Available: Change from virtual network integration to a private endpoint capable network configuration in Azure Database for PostgreSQL flexible server
  Azure Database for PostgreSQL Flexible Server can migrate from virtual network integration to a private endpoint-capable configuration, improving security and network flexibility with no downtime.
• Generally Available: Azure Database for PostgreSQL stable REST API version 2026-10-01
  The newly GAed Azure Database for PostgreSQL REST API 2026-10-01 adds robust maintenance tools, immutable backups, and enhanced multi-tenant encryption for secure, scalable workloads.
• Public Preview: Extend immutability for PITR backups for Azure SQL Database and Azure SQL Managed Instance
  The public preview allows Azure SQL Database and Managed Instance users to extend their point-in-time recovery (PITR) backup immutability from 7 to 35 days to comply with regulations.
• My Team Is Growing, How Do I Structure Who Gets Access to What?
  Azure Cosmos DB recommends structuring access by job function and workload, using distinct control-plane and data-plane roles to limit privileges and prevent accidental overexposure as teams expand.
• Batch Mode on Rowstore SQL Server Indexes
  Batch Mode on Rowstore SQL Server indexes enhances aggregation query performance by processing data in batches, reducing overhead and improving speed for large datasets.
• New ransomware recovery guidance for Azure SQL Database and Azure SQL Managed Instance
  The new Azure Learn guide provides a seven-step ransomware recovery framework for SQL Database and Managed Instance, focusing on early containment, clean restore points, evidence preservation, and proactive hardening.
• mssql-python 1.17.0: more reliable bulk copy, faster pool recovery, and DB-API fixes
  mssql-python 1.17.0 improves bulk copy reliability after upgrades, fixes UTF-8 handling and dead connection recovery, enhances row count accuracy for multi-statement batches, and aligns Timestamp() behavior with PEP 249 standards.
• Using CosmosDB for Chat History and Semantic Caching
  Lino’s Azure Cosmos DB Conf 2026 session shows how to use the platform for both short-term chat history and long-term semantic caching, optimizing AI response times through vector similarity searches.
• Importing Excel files into SQL Server, Azure Edition
  Azure Functions triggered directly by Blob Storage events automate Excel-to-SQL migrations, eliminating the need for additional Logic Apps orchestration.
• ANSI String Concatenation in SQL Server 2025 and Azure SQL Database
  SQL Server 2025 adds the ANSI-standard `||` operator for string concatenation, converting non-string types and handling NULLs similarly to the `+` operator with implicit type conversion like CONCAT().
• PostgreSQL Performance Bottlenecks: Managing Connections and Read-Intensive Workloads
  Managing too many database connections in PostgreSQL can significantly slow performance by increasing memory and CPU usage; using a connection pooler like PgBouncer helps reuse existing connections, reducing latency and improving throughput for read-intensive workloads.

🛠️ Developer tools

• Retirement: Azure Fluid Relay
  Azure Fluid Relay will be retired on February 2, 2027, ending its availability and potentially disrupting dependent workloads, though the underlying Fluid Framework will remain open source.
• Deprecation of Legacy Web Browser Control
  The legacy Internet Explorer-based Web Browser Control in Microsoft Access will be deprecated on May 18, 2027, with version 2705, prompting users to switch to the Edge Browser Control for continued functionality and compatibility.
• Build an Offline AI Voice Notebook on Raspberry Pi with Microsoft Foundry Local
  Build an offline AI voice notebook on Raspberry Pi with Microsoft Foundry Local to capture, transcribe, and summarize spoken reflections locally without cloud upload.
• GitHub Copilot Fusion: choosing effort instead of models
  GitHub Copilot Fusion streamlines development by letting users select and compare multiple AI models within a single workflow, improving efficiency for both simple edits and complex engineering tasks.
• PowerShell 7.7 and DSC 3.3 with Jason Helmick
  Jason Helmick explains that DSC 3.3 is a lightweight cross-platform configuration engine driving tools like WinGet Configure and details PowerShell's approach to facilitating enterprise migration from Windows PowerShell 5.1 to version 7 with integrated security improvements.
• Extending Azure VM Image Automation with an MCP Operations Layer
  Azure DevOps pipelines gain an MCP interface that allows developers to query build metadata and trigger guarded image-baking tasks directly from Visual Studio Code Copilot Chat.
• Copilot Agent Kit, installation
  Installing the Copilot Agent Kit involves enabling relevant features, installing the Creator Kit, and completing setup in the Power Platform Admin Center within about 40 minutes.
• Local AI in GitHub Copilot: plenty of RAM, still out of memory?
  Reducing the MAI Code 1.1 Flash model's context size to 32,768 tokens or less was necessary for running it locally in GitHub Copilot due to insufficient GPU VRAM despite having four NVIDIA Tesla T4 GPUs and ample system RAM.
• VS Code 1.145 Expands Remote Agent Workflows, Adds Cron Automations
  VS Code 1.145 introduces a remote agent browser and canvas for enhanced workflow management, along with improved local automation flexibility and session control features.
• PowerShell MCP Server: Automate Windows Admin Tasks
  PowerShell MCP Server lets you automate essential Windows administration tasks by creating a secure, read-only API that Claude Desktop can interact with.
• Microsoft Shows How to Run Qwen Coding Agents Locally with GitHub Copilot
  Microsoft demonstrates running Qwen coding agents locally with GitHub Copilot, leveraging Foundry Local and NVIDIA hardware for enhanced performance and security.
• GitHub Copilot to End Support for JetBrains 2025.2 IDE Releases
  GitHub Copilot will no longer support the JetBrains 2025.2 IDE, shifting its minimum required version to 2025.3.x for upcoming plugin updates.
• Microsoft Details 53 GiB Local Coding Model for GitHub Copilot
  GitHub Copilot’s new 53 GiB local coding model leverages mixed-precision quantization to run efficiently on RTX Spark hardware, enabling faster and more accurate code suggestions.
• Before replacing LINQ, read what it becomes
  Replacing LINQ's Any predicate in Azure Service Bus reduced delegate allocation but only benefited certain input cases, revealing performance gains for specific workloads without justifying a general LINQ replacement.
• Microsoft Foundry Extension for Azure Developer CLI Reaches GA
  The GA release of the Microsoft Foundry Extension for Azure Developer CLI introduces a streamlined workflow for managing hosted AI agents throughout their entire lifecycle.
• If Syntax Was Never The Goal, What Is The Job Now?
  Microsoft Agent Framework powers a prototype team of virtual agents that generate project artifacts, though human oversight remains essential for scope control and consistency.

🔩 DevOps

• Azure DevOps: Fix "Acquiring an agent from the cloud"
  Azure DevOps resolves the “Acquiring an agent from the cloud” issue by recommending checks for pool saturation, job limits, network permissions, and firewall blocks before modifying YAML files.
• Force Security Scans with Azure DevOps Extends Templates
  The extended Azure DevOps template automatically fails builds and enforces required security scans via service connections, enhancing code protection.
• AI Applications Scanning in GitHub Advanced Security: Catching Prompt Injection in the Pull Request
  GitHub Advanced Security introduces AI applications that scan pull requests for prompt injection vulnerabilities, enhancing code safety with automated detection.
• GitHub Backup Tool - update 1.4.0.0 is out
  GitHub Backup Tool version 1.4.0.0 introduces automated daily backups and enhanced encryption for secure repository preservation.
• October 2026 Node.js vulnerabilities: Azure DevOps security guidance
  Azure DevOps provides tailored remediation guidance for Node.js vulnerabilities in October 2026, including specific patch levels and update processes for self-hosted agents and pipeline tools.
• Inside GitHub’s new Git storage architecture
  GitHub's new architecture supports thousands of concurrent agents handling up to 7,200 pushes per second with low latency reads, facilitating agentic development for hundreds of millions of developers.
• Cleaning up unaffiliated users in GitHub Enterprise Cloud with the GraphQL API
  This guide shows how to automate removing unaffiliated users from GitHub Enterprise Cloud via the GraphQL API and GitHub CLI, detailing listing, filtering, deletion processes, and exception handling.
• Beyond code generation: A developer’s guide to agentic engineering
  Agentic engineering on GitHub streamlines planning, building, verifying, and observing software using tools like Copilot, Slack/Teams integrations, and GitHub Agentic Workflows to maintain team alignment and productivity amid higher commit volumes.

🧬 Hybrid + multicloud

• Azure Local: 10 mistakes that can derail your deployment before it starts
  Azure local deployment failures frequently result from initial choices like opting for a hypervisor instead of a hybrid platform or omitting landing zone discussions, underscoring the need for careful planning and design reviews.

🎭 Identity

• Use Open.IdentityServer for OpenID Connect in an Aspire setup
  Open.IdentityServer integrates with ASP.NET Core Identity and Aspire to provide a comprehensive OpenID Connect server solution, supporting real-time authentication flows and secure token management for web applications and APIs.
• Microsoft Entra Global Secure Access: one offering for Private Access and Internet Access
  Microsoft Entra Global Secure Access unifies private and internet access under one offering, applying Zero Trust principles without needing separate tools or policies.
• Microsoft USER (User Security Evaluation Reporter) Rearchitected for Entra ID
  The rearchitected Microsoft USER tool runs securely as a Node 24/TypeScript web app on Azure App Service, using Entra ID for authentication and managed identities to access the Microsoft Graph API.
• Scale access controls with Microsoft Entra Conditional Access policy plans
  Microsoft Entra Conditional Access policy plans simplify enterprise-scale access control by defining security intent once and enforcing it consistently, improving clarity and reducing administrative overhead.
• Entra MemberOf replacement heads behind Governance paywall
  Microsoft is moving the Entra MemberOf replacement into its Entra ID Governance service, introducing a licensing fee that may increase costs for organizations managing basic group permissions.
• Entra Agent IDs: How to Stop AI Privilege Escalation
  Entra Agent IDs structure prevention of AI privilege escalation through mapping four key objects, following four paths for tenant control, and applying eight security controls.
• Agent Governance on Microsoft Foundry, Part I: Which identity makes the call?
  Agent Governance on Microsoft Foundry details how Entra identities, managed identities, and Azure RBAC collaborate to authorize agent-service interactions, emphasizing each identity's unique role in authentication and authorization.
• Passkey Provider AAGUIDs PowerShell Module Now Refreshes Automatically Every Week
  The Passkey Provider AAGUIDs PowerShell module automatically refreshes its cached AAGUID list weekly via GitHub Actions and publishes updated versions to the PowerShell Gallery without user intervention.
• Microsoft adds hard deletion protection for Entra ID
  With the new hard deletion protection, Entra ID prevents permanent removal of user accounts for seven days, complemented by Protected Actions and Conditional Access controls in the preview.
• Microsoft Graph API MCP Server: Automate User Provisioning
  The new Microsoft Graph API MCP server automates user provisioning by enabling developers to create disabled test accounts, apply licensed permissions, and verify success via a Python local server.
• What’s new in Microsoft Entra: November 2026
  Microsoft Entra launches lifecycle policies, drift detection, group discovery, phishing-resistant MFA, and rapid continuous access evaluation for agent and guest identities.

🔌 Integration

• Generally Available: Geo-Replication on partitioned namespaces for Azure Service Bus Premium
  Azure Service Bus Premium now offers geo-replication for partitioned namespaces, enabling high-throughput messaging across regions with automatic failover and sub-second latency.
• Announcing general availability of Geo-Replication on partitioned namespaces for Service Bus Premium
  Azure Service Bus Premium now offers general availability of geo-replication for partitioned namespaces, enabling high throughput and regional message reliability by replicating data and configuration to a secondary Azure region.
• Connector Namespace to simplify exposing a SQL table via an API
  Connector Namespaces streamline exposing a SQL table via an API by reducing development and deployment overhead, though the author hopes for even greater simplicity in future updates.
• Build an AI-assisted invoice approval workflow with Power Automate and AI Builder
  This tutorial demonstrates how Power Automate and AI Builder automate invoice validation against SharePoint purchase orders, routing valid invoices for review while flagging issues such as missing PO numbers or duplicates.
• Logic Apps Standard custom code now supports .NET 10
  Azure Logic Apps (Standard) now supports .NET 10 custom code in Visual Studio Code, allowing seamless migration of existing .NET 8 projects without converting to separate Azure Functions apps.

💡 Internet of Things

• Azure IoT Central will be deprecated in 2029. Now what?
  Azure IoT Central will sunset in 2029, prompting organizations to explore alternatives like Azure IoT Hub or third-party SaaS platforms for their IoT solutions.
• IoT Hub with ADR and Certificate Management – Part 1
  The new Azure IoT Hub series introduces automated Device Provisioning Service integration, managed certificate issuance via ADR, and a 3D-printed Skittle sorter demo using the latest preview of the Microsoft.Azure.Iot.Device SDK version 2.0.0-preview4.
• IoT Hub with ADR and Certificate Management – Part 2
  Azure IoT Hub's Device Provisioning Service now supports X.509 onboarding with a bootstrap certificate and CSR flow, allowing direct device authentication and receipt of operational certificates from Azure Device Registry for secure, scalable IoT deployments.
• IoT Hub with ADR and Certificate Management – Part 3
  The updated Azure IoT CLI script creates system-assigned identities, links Device Provisioning Service before the IoT Hub, and integrates certificate management with ADR using X.509 onboarding and CSR issuance enabled by default.
• IoT Hub with ADR and Certificate Management – Part 4
  The new Azure IoT certificate management preview uses a two-phase approach for device authentication, issuing operational X.509 certificates with configurable lifespans from the namespace’s ADR CA via CSR submission, enhancing security over manual key transport methods.
• IoT Hub with ADR and Certificate Management – Part 5
  This version introduces unified SDK clients for provisioning and telemetry using Azure IoT Device v2.0-preview4, replacing custom C# code while maintaining support for symmetric-key/X.509 profiles and CSR onboarding flows in the IoT Hub with ADR and certificate management series.

🎓 Learning and Certifications

• ChatGPT runs on Azure Cosmos DB. Prove you can build what’s next.
  The DP-420 certification focuses on building AI applications with Azure Cosmos DB including vector and hybrid search, RAG, agent memory, and conversation state, offering free onsite testing for registered attendees at the upcoming Microsoft Ignite event in San Francisco.
• Windows Server at Microsoft Ignite 2026: Sessions, our booth, and how to join the pre-day
  The Windows Server pre-day workshop provides insights on server management in cloud environments and previews AI, security, and networking upgrades for $325 as an additional fee to Ignite registration.
• Microsoft Foundry for Beginners: Deploy Your First Model and Write Prompts That Work
  This beginner’s video guides viewers through deploying their first AI model in Microsoft Foundry and creating effective prompts to aid in passing the Azure AI Fundamentals (AI-901) certification exam.
• Keep learning, keep building! Make the most of VSLive! with your Visual Studio Subscription
  VSLive! provides hands-on labs, expert tours of new tools such as Copilot and Microsoft Foundry, and interactive AI comparisons, offering up to $900 discounts for Visual Studio subscribers.
• Your guide to FinOps for AI at Microsoft Ignite 2026
  FinOps for AI at Microsoft Ignite 2026 focuses on integrating finance, IT, engineering, and business teams to optimize AI spend predictability, accountability, and real business value delivery.
• Microsoft Entra deep dives: Join our December 15–17 webinar series
  The December 15-17 webinar series following Ignite will cover scaling secure access, strengthening governance and resilience across identities, and managing AI agents with practical scenarios and new capabilities to enhance identity security.
• People are the difference: The learning culture behind Investec’s workforce transformation
  Investec transformed its workforce by fostering a learning culture and people-first mindset through Azure certifications and continuous training for cloud and AI adaptation.
• Catch Microsoft Entra at Ignite 2026
  At Ignite 2026 explore live sessions on user and AI agent security with keynotes from top execs and demos of new Entra features for combating identity attacks and simplifying access policies.
• GitHub Universe: Where MVPs and GitHub Stars share ideas and build community together
  GitHub Universe gathered numerous Microsoft MVPs who are GitHub Stars to promote knowledge sharing via hands-on projects such as custom nameplates and makerspace activities, emphasizing community connection over technical tools.
• Visual Studio Subscribers Offered Up to $900 Off VSLive! Events
  Visual Studio subscribers can receive up to $900 off at VSLive! events, along with access to hands-on developer training sessions.
• Recent and upcoming Microsoft exam changes – Saturday 7 November 2026
  The post details recent and upcoming changes to several Microsoft certification exams, with a focus on updates to the SC-100: Microsoft Cybersecurity Architect exam scheduled for 7 November 2026.

⚖️ Management and Governance

• Article 5 - The 90-Day Agent Governance Plan
  The 90-day Agent Governance Plan outlines a practical method to discover, own, and map AI agents before implementing policies, transitioning from general awareness to precise control over agent usage.
• Why Did Our Azure Bill Change? Investigating Cloud Spend with Azure SRE Agent
  The Azure SRE Agent offers an interactive workflow linking Cost Management, Resource Graph, Advisor recommendations, and reusable skills to swiftly pinpoint cost drivers and produce customizable reports for FinOps teams.
• From Proactive Detection to Action: How Azure Protects Mission-Critical Workloads
  Azure's AFPD system employs machine learning and telemetry to predict, detect, mitigate, and remediate hardware failures in critical workloads, minimizing disruptions through proactive monitoring and notifications.
• Ghosts in the Directory Switcher: Cleaning Up the Azure Tenants You Forgot You Joined
  Azure directory switchers often accumulate stale guest accounts from past consulting projects, creating security risks that require manual cleanup through the portal settings.
• Who, not just what: Identity-aware Azure Policy for real-time governance
  Azure Policy now evaluates the requesting identity to govern both what changes are allowed and who can perform them, demonstrated by blocking manual deletions, requiring MFA for sensitive operations, and allowing only approved tools.
• Preparing Your IIS VM for Azure SRE Agent: A Reader-Only Guide
  This guide explains how to configure an Azure IIS virtual machine so the SRE Agent can collect essential logs, metrics, and configuration data for effective diagnosis without needing to run commands on the server itself.
• Automate Azure Cleanup with Bicep Deployment Stacks
  Automate Azure cleanup using Bicep by creating a deployment stack that previews deletions, ensuring resources are removed efficiently without unexpected charges.

🚌 Migration

• Generally Available: Azure Site Recovery for Azure Local
  Azure Site Recovery's GA for Azure Local simplifies enterprise disaster recovery with seamless protection for Windows and Linux VMs, enhancing security and reducing setup complexity.
• Generally Available: Enhanced Azure Site Recovery support for VMSS Flex
  Azure Site Recovery’s new GA feature enhances disaster recovery for VMSS Flex by streamlining target setup and reducing failover time to under 10 minutes.
• Public Preview: On-prem NAS share discovery and assessment are now available using Azure Migrate
  Azure Migrate’s public preview introduces on-premises NAS share discovery and assessment capabilities for Dell PowerScale (OneFS) and NetApp ONTAP, enabling more accurate migration planning to Azure.
• Migrate Arc-registered SQL Server instances to Azure without deploying the Arc agent
  Azure now allows direct migration of Arc-registered SQL Server instances to Azure SQL Managed Instance, SQL Server on Azure VMs, or Azure SQL Database via Log Replay Service, backup and restore, or Azure Database Migration Service.
• Discover and assess on-premises Network Attached Storage (NAS) shares using Azure Migrate
  Azure Migrate's new NAS share discovery and assessment preview automates inventory across Dell PowerScale/Isilon and NetApp ONTAP clusters, offering readiness scores, Azure service recommendations, cost estimates, and integrated planning tools for smooth migration.

🌐 Networking

• Generally Available: Route maps for Azure Route Server
  Azure Route Server’s new route maps offer detailed management of inbound and outbound routing for hybrid connections, enhancing network configuration flexibility.
• Generally Available: WAF Insights for Azure Application Gateway
  Azure’s WAF Insights GA provides integrated dashboards for visualizing and investigating blocked requests from consolidated log and metric data.
• Generally Available: Azure Front Door TLS key exchange policy with post-quantum support
  Azure Front Door now offers a GA TLS key exchange policy with post-quantum support to protect connections from future quantum threats while staying compatible with current clients.
• Public Preview: Private ingress for Application Gateway for Containers
  Application Gateway for Containers introduces private ingress capabilities via Azure Private Link, allowing secure, internal-only access to containers without exposing them to the public internet.
• Public Preview: MCP gateway for Application Gateway for Containers
  The public preview introduces an MCP gateway enabling seamless Model Context Protocol routing within Application Gateway for Containers, centralizing MCP server management with built-in TLS and authentication.
• Public Preview: JWT validation for Application Gateway for Containers
  Application Gateway for Containers introduces public preview of JWT validation via AuthPolicy, enabling teams to verify token authenticity, issuer, expiration, and audience with secure key retrieval from trusted sources.
• Public Preview: Azure Firewall IPv6 now supports application rules
  Azure Firewall’s new IPv6 public preview introduces application rules for layer 7 filtering of IPv6 HTTP and HTTPS traffic, supporting dual-stack environments and enhancing security consistency.
• VWAN simulator: a digital twin for Virtual WAN
  The VWAN simulator is an AI-powered tool allowing network admins to model Azure Virtual WAN topologies in real time, auto-generating routing tables and identifying issues such as asymmetric routing without registration or data upload.
• What if your Azure Databricks workspaces have overlapping CIDRs?
  Azure Databricks recommends using uniquely addressed private endpoints in a Transit VNet to avoid overlapping CIDRs, enabling enterprise users to privately access workspace services without routing through shared compute networks.
• Route summarization in Azure Route Server
  Azure Route Server's new route maps provide native policy control over hybrid network traffic, reducing route count via summarization and securing path selection across ExpressRoute, VPN, SD-WAN, and NVA connections.
• Azure Front Door now Supports Post-Quantum Resilient Hybrid TLS 1.3
  Azure Front Door now supports hybrid post-quantum TLS 1.3 using NIST-standardized ML-KEM and classical elliptic curves to safeguard against future quantum threats while maintaining compatibility with current applications.

🔐 Security

• Retirement: OT security in Microsoft Defender for IoT
  Microsoft will retire its OT security feature in Defender for IoT by October 2029, prompting users to migrate to alternative industrial cybersecurity solutions during the three-year transition period.
• What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
  This analysis shows that exploited vulnerabilities mainly facilitate system takeover, especially through remote code execution, privilege escalation, and authentication bypass, emphasizing the need for prioritized defense against high-likelihood and broad impact threats.
• Hunting Impossible Travel in Sentinel with KQL
  KQL allows security teams to build custom impossible travel detections that offer more transparency and tuning flexibility than Entra's built-in black-box risk signals.
• Fake-download campaign uses trojanized installers to deliver monetization payloads
  The campaign uses trojanized Inno Setup installers to covertly deliver various monetization payloads masquerading as software cracks and free utilities, installing proxies, compute, or adware via per-offer callbacks without user consent.
• What stops a service-side auto-labeling rollout from being approved — and how to unblock it
  Service-side auto-labeling requires addressing four core concerns regarding access, proof, reversibility, and scale to secure stakeholder approval.
• The CISO Cheat Sheet to Microsoft Digital Defense Report 2026
  The 2026 Microsoft Digital Defense Report shows AI significantly cuts the time, expertise, and cost required for attackers to find and exploit vulnerabilities, shortening attack timelines and facilitating more autonomous cyber operations.
• Securing AI Adoption in the DIB-Part 2: Microsoft's Approach to Discovering & Securing AI
  Microsoft outlines a Zero Trust approach for securing AI adoption in the Defense Industrial Base, focusing on identity management, data governance, and lifecycle oversight with extended security for generative AI tools like Copilot.
• Security Fix: Azure Sphere SDK version 26.06.1 is now available
  The security fix releases Azure Sphere SDK version 26.06.1 to remove trust in compromised eMudhra intermediate CA keys, preventing potential man-in-the-middle attacks on authenticated TLS connections.
• Secure AKS with Microsoft Defender for Containers for Code-to-Cloud Security
  Defender for DevOps integrates with AKS to offer comprehensive code-to-cloud security by linking repository issues to cloud risk assessments, improving visibility for engineers and security teams.
• Email threat landscape: Q3 2026 trends and insights
  The report shows a 41% increase in email phishing threats to nearly 3 billion users in September 2026, with CAPTCHA-gated phishing rising due to SVG attachments, indicating new tactics beyond QR codes and traditional methods.
• What’s new in Microsoft Security: November 2026
  The November 2026 update to Microsoft Security adds Dynamic Permissions, Secure AI for agent risk management, and enhanced least-privilege support in Intune Endpoint Privilege Management.
• New investments to reduce on-premises security risk
  Microsoft launches On-Premises Baseline Security Mode to automatically apply hardened security configurations to supported server workloads, reducing manual effort for maintaining strong defenses.
• Threat actors use agentic AI tooling to find and abuse exposed secrets
  Threat actors leverage agentic AI tooling to rapidly discover and exploit exposed secrets across GitHub, enabling swift cloud compromise and data exfiltration within minutes.
• Troubleshoot DataStream with VirtualMetric AI for Microsoft Sentinel
  VirtualMetric AI automates issue detection and diagnosis in the DataStream pipeline to Azure SIEM, improving incident response.
• ARTEX abuse expands as cybercriminals target financial sector
  Storm-3358 targets Southeast Asian financial institutions and global firms using the ARTEX agentic AI framework for vulnerability scanning, deploying open-source RATs with tools like netcat and curl, and conducting credential theft and lateral movement.

📦 Storage

• Generally Available: Azure Storage Actions adds automatic task updates, execution controls, and case-sensitive matching
  Azure Storage Actions now offers automatic task updates, fine-grained execution controls, and case-sensitive matching to streamline automated data workflows in Blob and Data Lake Storage.
• Public Preview: Advanced capacity insights are now available in Azure Storage Discovery
  Azure Storage Discovery's public preview offers advanced capacity insights like access patterns, data age, storage tiers, and object size distribution to enhance cloud storage efficiency.
• Public Preview: Multi-disk crash-consistent VM restore points for Premium SSD v2 and Ultra Disks on VMs with SCSI disk controller
  Azure offers a public preview of crash-consistent VM restore points for Premium SSD v2 and Ultra Disks using SCSI controllers, allowing seamless agent-less data recovery.
• Enhanced data protection for Azure Files
  Azure Files now provides vaulted backup for NFS shares, snapshot revert capabilities for rapid recovery, and Storage Mover support to keep secondary copies in any region, enhancing business continuity and disaster recovery.
• Accelerate data access for inference and training with the open-source distributed accelerator for cloud storage
  DACS speeds up AI tasks by caching often-used blob pieces on GPU nodes, lowering latency for datasets and models while still using Azure Blob Storage as the reliable backup.

💻 Virtual Desktop Infrastructure

• What’s new in Windows 365: October 2026 recap
  Windows 365 adds RDP Multipath and Shortpath improvements, session state retention in dedicated Flex mode, and extended external identity support via Windows App on iOS to enhance productivity and security.