Azure Weekly

Issue 576

23^rd August 2026

Highlights this week include:

• The August 17 outage, and the work ahead by Vlad Fedorov - GitHub's recent outages underscored the necessity for faster reliability enhancements such as scaling infrastructure, optimizing Azure use, and improving operations to manage increased commits, pull requests, and Actions runs.
• Announcing General Availability of Managed Instance on Azure App Service by Gaurav Seth - Managed Instance on Azure App Service now provides a 99.95% production SLA, expanded regional availability in eight locations, and enhanced integration with Premium v4 features, simplifying enterprise migration of legacy .NET Framework applications with minimal code modifications.
• AKS Hyperscale Control Plane Now in Preview by Richard Hooper - Azure Kubernetes Service now offers a hyperscale control plane preview enabling users to specify tiered capacity guarantees during cluster creation for enhanced performance and reliability.
• Azure Quick Review (azqr) v4.0.0: What You Need to Know by Carlos Mendible - Azure Quick Review v4.0.0 adds VM sizing, Service Health analysis, SQL Server lifecycle management, and region selection capabilities with breaking changes requiring script reviews for upgrade.

And four AI related posts from my colleagues:

• How to trust your AI-assisted data analysis by James Broome - Trust in AI-assisted data analysis hinges on maintaining a clear audit trail of how results are derived, emphasizing the need for reproducible code over polished but unverifiable outputs.
• How to Implement Retrieval in RAG a 3-part series by Carmel Eve - Implementing effective retrieval in RAG is crucial because it ensures only relevant information is used, improving LLM response quality while enabling document citation and continuous knowledge updates. How to Implement Augmentation in RAG: Augmentation in Retrieval-Augmented Generation structures prompts with system instructions, retrieved context, and the user's question to guide LLMs toward accurate, context-aware responses while managing token limits and document formatting. How to Implement Generation in RAG: Generation in RAG depends critically on effective retrieval and augmentation for producing high-quality model responses.

🤖 AI

• How to Implement Retrieval in RAG
  Implementing effective retrieval in RAG is crucial because it ensures only relevant information is used, improving LLM response quality while enabling document citation and continuous knowledge updates.
• How to Implement Augmentation in RAG
  Augmentation in Retrieval-Augmented Generation structures prompts with system instructions, retrieved context, and the user's question to guide LLMs toward accurate, context-aware responses while managing token limits and document formatting.
• How to Implement Generation in RAG
  Generation in RAG depends critically on effective retrieval and augmentation for producing high-quality model responses.
• Add a Microsoft Foundry model to the GitHub Copilot app
  The GitHub Copilot app now supports integration of personal or Foundry-deployed models for BYOK setups with low latency through Azure OpenAI’s v1 Responses API.
• Expanding Open Model Choice in Microsoft Foundry with New DeepSeek and NVIDIA Nemotron Models
  Microsoft Foundry expands its open model selection with DeepSeek-V4-Flash-0731 and NVIDIA Nemotron 3.5 Lightning for improved agentic AI performance and tool use across multilingual workflows via Azure Direct, Fireworks on Foundry, and Hugging Face.
• Choosing the Right Agent in Microsoft Foundry
  Choosing between Prompt and Hosted Agents in Microsoft Foundry depends on whether you prefer managed orchestration logic for declarative agents or implementing it within your code for more control with hosted agents.
• Evidence to Decision: building an AI-envisioning workshop tool on Azure
  Evidence to Decision is an Azure-based AI tool that captures meeting evidence, drafts recommendations via AI, and retains decision authority with human reviewers.
• Build a SAFE Agent on Microsoft Foundry
  The SAFE framework helps help desk agents address sign-in issues through appropriate scope, evidence, procedure, and escalation using ACS in Microsoft Foundry.
• Browser automation with Pydantic-AI + Playwright
  Pydantic-AI with Playwright enables secure, programmable web browsing for agents, including page opening, navigation, and content extraction via Azure identity authentication and customizable token limits.
• Local transcript cleanup in .NET with s1-mini
  ElBruno.S1Mini is a .NET library that integrates the s1-mini model to normalize raw ASR transcripts into clean, human-readable text without requiring any network access.
• Model router updates: new regions, a refreshed model pool, and understanding the hill climb
  Model router now supports Anthropic Claude Opus 4.8 and GPT-5.6, removes deprecated models, and expands to 28 global and 21 data zone regions with automatic updates.
• How to trust your AI-assisted data analysis
  Trust in AI-assisted data analysis hinges on maintaining a clear audit trail of how results are derived, emphasizing the need for reproducible code over polished but unverifiable outputs.
• Build AI agents without leaving VS Code, join our 3-part Reactor Series
  The free three-part Reactor Series teaches developers to build, debug, and deploy AI agents in VS Code using the Microsoft Foundry Toolkit, with hands-on sessions on executive briefing agents and multi-agent career copilots.

🔎 Analytics

• Generally Available: Azure Databricks Lakebase in four additional regions
  Azure Databricks Lakebase’s general availability in North Central US, France Central, Germany West Central, and East Asia regions expands deployment choices and improves geographic coverage for data lakehouse workloads.
• Automating OSM Data Refresh in Power BI’s Azure Maps Reference Layer
  Automating OSM data refresh in Power BI’s Azure Maps reference layer uses a static geoJSON file with updated URL, proper CORS, and MIME settings for real-time map updates.
• Fabric Eventhouse tables in a Semantic Model: one solution works best
  This article shows how to efficiently integrate Fabric Eventhouse KQL Database tables into a Semantic Model in Fabric Apps for real-time updates using OneLake and the DataApp template.
• Providing comparative context with DAX Calculated Tables under Row Level Security
  This article explains how DAX calculated tables offer comparative context under Row Level Security in Power BI without revealing sensitive data, solving the issue of restricted users lacking access to benchmarks such as regional averages.
• When Your Microsoft Fabric Capacity Runs Out: Optimize, Scale Up, Scale Out, or Isolate?
  Assess whether to optimize, scale up, scale out, or isolate workloads based on real-time metrics when Azure Fabric capacity runs out.
• 10 Things I Hate About Fabric Deployment Pipelines— And Some Alternatives
  Fabric deployment pipelines in August 2026 suffer from unclear permission management, requiring separate roles for pipeline access and workspace content, making meaningful deployments cumbersome.

🖥️ Compute

• Generally Available: vCore Customization: Disable Multithreading and Configurable Constrained Cores
  Azure now offers GA vCore customization to let users disable multithreading and configure constrained cores, giving finer control over VM performance for demanding workloads.
• Public Preview: Azure Linux on WSL
  Azure Linux on WSL’s public preview lets developers validate app behavior with production configs, reproduce bugs more reliably, and cut debugging time by simulating real environments locally.
• Retirement: Azure VMware Solution License-included service will be retired August 30, 2027
  Azure VMware Solution will stop offering its previously license-included service on August 30, 2027 due to Broadcom's policy change requiring customers to bring their own portable VMware licenses.
• What Is Windows Server vNext?
  Windows Server vNext features identity modernization with post-quantum cryptography, default transport hardening via mandatory SMB signing, secure SMB over QUIC, and encrypted RPC interfaces, setting a forward-looking foundation for enterprise infrastructure.
• Building Event-Driven Agents with Azure Functions
  Azure Functions' serverless agents runtime lets developers define event-driven AI agents in Markdown, automatically registering triggers and running them with the Microsoft Agent Framework, simplifying integration for tasks like scheduled news digests without needing separate timer functions.
• The OpenVMM Project
  OpenVMM, an MIT-licensed Rust VMM project with nearly 100 contributors, has expanded through partnerships like Intel and Arm, incorporating cross-platform support, advanced device emulation, improved CI infrastructure, and confidential computing for Azure VMs.
• Announcing General Availability of Disable Multithreading and Configurable Constrained Cores
  Azure launches GA features for disabling Simultaneous Multithreading/Hyper-Threading and configuring constrained cores to enhance performance and cut licensing costs for various workloads.

🚢 Containers

• Beyond Deployment: What It Really Takes to Run GitHub Actions Runners on AKS
  Careful operational decisions are needed for running GitHub Actions runners on AKS using the Actions Runner Controller to ensure security, supportability, observability, and multi-team readiness.
• Top 10 Ways to Reduce .NET Memory Usage in Kubernetes
  Setting realistic Kubernetes memory limits for .NET pods-using requests of 512 MiB and limits of 768 MiB-helps control pod density and reduces overall cluster costs by preventing excessive RAM usage.
• AKS Shared Maintenance Windows (Preview): One Schedule Across Multiple Clusters
  AKS Shared Maintenance Windows schedules maintenance for multiple Azure Kubernetes Service clusters at once, reducing management overhead and ensuring consistent downtime.
• AKS Hyperscale Control Plane Now in Preview
  Azure Kubernetes Service now offers a hyperscale control plane preview enabling users to specify tiered capacity guarantees during cluster creation for enhanced performance and reliability.
• Simplify AKS observability with Azure Native New Relic Service
  Azure Native New Relic Service streamlines observability for AKS by integrating New Relic monitoring directly into Azure, allowing consistent visibility across clusters with minimal manual setup.
• Advanced Container Networking Services on AKS: X-Ray Vision and Kernel-Level Guardrails for Your Cluster Network
  Advanced Container Networking Services on Azure Kubernetes Service provides eBPF-powered network observability with Hubble, domain-based egress filtering, and HTTP-aware Layer 7 policies, showcased in a hands-on setup.

🗄️ Databases

• Generally Available: Azure SQL Database provisioning in MSSQL extension
  Azure SQL Database provisioning in the MSSQL extension lets developers create and access fully managed cloud databases seamlessly within their code editors without any associated costs.
• Generally Available: Azure SQL updates for mid-August 2026
  Azure SQL now offers customizable keyboard shortcuts for Quick Queries, Results Grid, and the Query Editor in Visual Studio Code, enhancing workflow efficiency without switching applications.
• Public Preview: Zone redundancy for Azure SQL Managed Instance Next-gen General Purpose
  The public preview of zone redundancy for Azure SQL Managed Instance Next-gen General Purpose enhances resilience by automatically spreading compute and data across multiple zones, improving business continuity without manual intervention.
• Public Preview: Zone-Redundant Next-Gen General Purpose for Azure SQL Managed Instance
  Azure SQL Managed Instance introduces a public preview of zone-redundant Next-Generation General Purpose for enhanced high availability and compliance without compromising performance.
• Azure SQL Data Sync Fails with "Cannot Insert NULL": Understanding the Root Cause
  Azure SQL Data Sync may encounter "Cannot insert NULL" errors due to mismatches in tracking metadata and source table definitions, often stemming from schema inconsistencies or orphaned tracking records.
• Getting Started with Azure SQL Data Sync Using User-Assigned Managed Identity (UAMI)
  Azure SQL Data Sync now supports User-Assigned Managed Identity (UAMI) for authentication, offering enhanced security and simplified credential management compared to traditional SQL Authentication.
• Managing SQL Server on Linux Azure VMs with the SQL IaaS Agent Extension
  The SQL IaaS Agent extension connects Linux-based SQL Server on Azure VMs to Azure's management tools for seamless licensing management, compliance tracking, and improved visibility without extra costs.
• JSON indexing in SQL Server 2025: how it works and current limitations
  SQL Server 2025 introduces native JSON indexing with CREATE JSON INDEX, allowing direct indexing of JSON values without computed columns, though it remains a preview feature with current limitations.
• New Claude Plugin For SQL Server Query Plan Analysis
  The new Claude plugin for SQL Server offers automated query plan analysis to help developers quickly identify and optimize performance bottlenecks.
• Performance Monitor is Going Enterprise
  Performance Monitor is moving toward an enterprise solution by deprecating the full dashboard, keeping a lightweight version, and adopting PostgreSQL with TimescaleDB for better scalability and data compression.
• Azure Managed Redis Deployment Automation
  The PowerShell script automates Azure Managed Redis deployments by retrying cache creation with varying SKUs and intervals until success or capacity limits are addressed.
• From 17ms to 0.04ms: How to Design the Right SQL Index
  A good SQL index is designed based on specific application queries, placing equality columns first in composite indexes to optimize performance; for example, indexing issue_id, user_id, and created_at DESC reduces a complex query from 16.6 ms to just 0.04 ms by leveraging the leftmost prefix rule and sorted order within the index.

🛠️ Developer tools

• How canvases make agentic workflows visible, steerable, and cost-efficient
  Canvases in GitHub Copilot enhance agentic workflows by offering a shared collaborative surface that reduces context loss and review time.
• Azure Quick Review (azqr) v4.0.0: What You Need to Know
  Azure Quick Review v4.0.0 adds VM sizing, Service Health analysis, SQL Server lifecycle management, and region selection capabilities with breaking changes requiring script reviews for upgrade.
• Why Cloud Browsers Are Becoming Enterprise Infrastructure for AI Agents and Automation
  Cloud browsers provide enterprise-grade, secure, scalable, and observable environments for AI agents and automation.
• Distributing Agents to Microsoft Teams and Microsoft 365 Copilot Part 4/5
  The fourth post explains how to publish agents directly to Teams and Copilot with one command, simplifying integration for enterprises.
• Documentation as Code - Can Infrastructure teams adopt and why should they?
  Documentation as Code improves quality, consistency, scalability, and traceability while enabling safe AI usage of infrastructure docs through Markdown and tools like MkDocs.
• .NET 11 Preview 7 Turns On NativeAOT CLI and MSBuild Server by Default
  .NET 11 Preview 7 enables the NativeAOT CLI and MSBuild Server by default, streamlining native compilation and continuous integration workflows for developers.
• Visual Studio Code 1.134 Puts Agent Sessions Front and Center
  Visual Studio Code 1.134 introduces multi-window agent sessions, allowing side-by-side chat interactions and enhanced conversation management with an integrated HTML preview tool.
• Voice Live and Observability for Production Agent Systems Part 5/5
  The final post shows how Azure AI Voice Live offers accessible spoken status updates for operators while Observability maintains accountability in autonomous systems via structured logging, OpenTelemetry spans, and Application Insights.
• SQL Formatter Previews in Microsoft's MSSQL VS Code Tool
  The new Visual Studio Code MSSQL extension adds an interactive T-SQL formatter preview and stabilizes two earlier formatting and syntax-checking features.
• Give your Copilot agents real tools, without hand-wiring MCP
  The new GitHub Copilot MCP Connectors canvas simplifies integrating external tools like SharePoint, Salesforce, and Outlook by automating authentication and scaling for agents.
• An Overview of Agent Memory for .NET
  Agent Memory for .NET uses a graph database to support AI agents' short-term, long-term, and reasoning memories, enabling bitemporal recall for nuanced responses within the Microsoft Agent Framework.
• Build a Local RAG Application in C# with Ollama and Qdrant – Part 2
  This C# tutorial demonstrates building a local Retrieval-Augmented Generation (RAG) application that indexes documents, retrieves information via Qdrant vector search, and generates answers using Ollama’s llama3.2 model, offering an educational introduction to RAG pipelines in .NET.
• Today I will… Modernize a .NET application
  The GitHub Copilot modernization tool in Visual Studio helps upgrade a .NET Framework app to .NET 10, introducing checkpoints for review and generating markdown records at each stage.
• My Go-Anywhere Dev Setup: Tern, Starlink Mini, and RDP Over Tailscale
  The author describes a portable development setup featuring a lightweight Fjällräven backpack, mechanical keyboard, and RDP over Tailscale for accessing their home server from anywhere.

🔩 DevOps

• Mark Seemann: AI Code Quality - Episode 415
  Mark Seemann discusses the challenges of maintaining code quality when using AI-generated code, highlighting a critical gap between current AI capabilities and real-world maintainability concerns.
• Apple Silicon and Xcode 27 images available in pay-as-you-go (preview)
  Azure Pipelines now provides pay-as-you-go Apple Silicon macOS agents in GitHub-hosted pools for native ARM64 builds on Azure with per-minute pricing and support for standard and XLarge image sizes.
• Understanding GitHub Billing and management: from licenses to fair AI credit controls
  Understanding GitHub’s billing and management system reveals how seat assignment, cost centers, AI credit caps, budgets, and user-level limits govern Copilot usage across business units.
• Building a Fully Automated Azure Landing Zone Deployment Using Azure DevOps and Terraform
  Building a Fully Automated Azure Landing Zone Deployment Using Azure DevOps and Terraform standardizes cloud environments by establishing management groups, subscriptions, networking, identity integration, security baselines, governance controls, and monitoring configuration through an automated pipeline that includes CI validation, environment promotion stages, and integrated governance policies.
• GitHub Copilot app for Beginners: Managing your work
  The GitHub Copilot app’s My work pane centralizes pull requests, issues, and custom views, allowing users to filter by status or assignee and create tailored sessions directly from items.
• Scheduled AI in practice: turning telemetry into a daily health report
  This article shows how to automate a daily app health report using Azure CLI telemetry, an AI summarization model, and scheduled runs in tools like Claude or Copilot.
• From Detection to Action: Extending Azure Monitor Issues with Action Groups
  From Detection to Action: Extending Azure Monitor Issues with Action Groups enables automated notifications, ticket creation, and remediation workflows via Logic Apps, Azure Functions, and other services when issues are detected.
• The August 17 outage, and the work ahead
  GitHub's recent outages underscored the necessity for faster reliability enhancements such as scaling infrastructure, optimizing Azure use, and improving operations to manage increased commits, pull requests, and Actions runs.
• GitHub reliability and scalability: a consequence of AI and too much for free
  GitHub's monthly commits surged from 1.4 billion to 2.9 billion due to agentic AI and programmatic development, straining reliability and prompting CEO Vlad Fedorov to address scalability through improved architecture and pricing.
• Turn conversations into code with GitHub Copilot in Microsoft Teams
  GitHub Copilot in Teams enables developers to @mention the tool for automatic code generation from team chats, enhancing feature development and bug fixing.
• Azure DevOps: Copy Azure Container Registry (ACR) Images to an External Tenant's ACR
  Azure DevOps provides a secure way to transfer images between registries without exposing sensitive credentials through role-based access and managed identities.

🧬 Hybrid + multicloud

• Episode 1: Onboarding Azure Arc at Scale | The Azure Arc Check-In
  This episode explains scalable onboarding strategies using non-interactive authentication, Ansible for Linux, and Group Policy for Windows to connect thousands of servers to Azure Arc.
• What’s new for small form factor infrastructure
  Version 2607 of Azure's small form factor infrastructure now supports multiple network interfaces and additional disks, enhancing networking flexibility for edge devices and introducing Just-In-Time device access to boost security.

🎭 Identity

• Configuring Microsoft Entra ID Authentication for Azure SQL Database using Azure Bicep
  This guide shows how to automate deploying an Azure SQL Server with built-in Microsoft Entra ID authentication using Azure Bicep, removing manual portal setups and following IaC best practices.
• Entra Inbound Provisioning to Active Directory Attribute Constraint Violated
  The post explains a rare “Attribute Constraint Violated” error encountered when using Entra to provision users into Active Directory, detailing the root cause and workaround.
• Microsoft adds user actions to the Security Administrator role
  With the updated Security Administrator role, administrators can now perform four critical identity actions to swiftly mitigate threats from compromised accounts.
• 356 - Renewing our understanding of Microsoft Global Secure Access
  Microsoft Global Secure Access now includes advanced features such as Intelligent Local Access and Private Access for AD domain controllers providing robust secure remote access solutions in 2026 with comprehensive deployment guides.
• Passkeys by Default: Entra Retires SMS and Voice MFA
  Microsoft Entra plans to retire SMS and voice multi-factor authentication by August 10, 2026, replacing it with passkeys as the default sign-in method due to security concerns over phishing risks.
• Microsoft quietly expands the Entra Application Developer role
  Microsoft has bolstered the Entra Application Developer role with 15 new permissions, such as credential updates and review assignments, enhancing security by addressing potential attack paths.
• Microsoft Entra brings passkeys to B2B guest users
  With the October 2026 rollout, Microsoft Entra ID will enable B2B guest users to authenticate using passkeys, streamlining access while maintaining robust MFA and policy controls.

🔌 Integration

• Managing APIM policies at scale: a practical guide to Azure APIM policy fragments
  Azure API Management Policy Fragments enable organizations to centrally manage reusable JWT validation logic, reducing duplication and enhancing maintainability across multiple APIs.
• From Azure Policy to APIM: Implementing Azure AI Guardrails
  Azure AI Guardrails combine Azure Policy for resource deployment governance with API Management to enforce runtime policies, ensuring secure and compliant AI application usage.
• Why I’m retiring my Logic App Standard managed identity workaround
  Retiring the Logic App Standard managed identity workaround benefits developers by allowing Visual Studio Code to support native managed identity authentication locally and in deployments, simplifying processes and enhancing security.
• Announcing Azure Web PubSub chat in public preview
  Azure Web PubSub chat is in public preview, offering managed APIs for rooms, messages, members, users, and roles with automatic scaling, geo-replication, security, and compliance.

🎓 Learning and Certifications

• Active Directory Domain Services modules on Microsoft Learn
  The Microsoft Learn modules on Active Directory Domain Services provide a comprehensive learning path covering foundational concepts to advanced domain controller management and Group Policy implementation.
• TRAINING: “FabCon & SQLCon 2026” Recap Series – On-demand
  The FabCon & SQLCon 2026 Recap Series summarizes key insights on AI integration, developer experience improvements, and the roadmap for expanding SQL capabilities within the Fabric ecosystem.
• Recent and upcoming Microsoft exam changes – Friday 21 August 2026
  The article details recent and upcoming modifications to several key Microsoft certification exams, including updates to the AZ-400 and SC-100 exam formats effective July 27 and 28, 2026.

⚖️ Management and Governance

• Azure Service Groups: The Missing Layer Between Governance and Operations
  Azure Service Groups offer a flexible method to organize resources across subscriptions and regions while preserving existing governance structures, improving operations, resiliency planning, and cost management in large enterprises.
• Generally Available: What-If for Azure Deployment Stacks
  Azure's new Stacks What-if feature offers a detailed preview of updates showing which resources will be deleted or detached to help teams confidently manage production deployment stacks with reduced noise and persistent resource IDs.
• Power Azure SRE Agent with the tools it needs
  The Azure Connector Namespace now manages remote MCP servers, streamlining integration with tools such as GitHub, Datadog, New Relic, Splunk, Azure SQL, GitLab, Jira, and PagerDuty to improve incident investigation and remediation.
• Azure Copilot Introduces Direct Access to Agents
  Azure Copilot enables direct access to specialized agents for troubleshooting, deployment planning, optimization, and resiliency, enhancing expert engagement and accelerating problem resolution.
• Who Ordered All These Tokens? Giving AI Spend a Name in FOCUS
  FOCUS introduces a customizable pattern for classifying AI spend by mapping Azure price sheet meters to token types, enabling accurate cost allocation despite scattered billing data.
• Stop restricting the agent. Start restricting its environment.
  Azure SRE Agent improves LLM tooling by restricting environments instead of limiting the agent, enabling safer autonomous operations via external layers that define accessible resources and task-specific authority.

🚌 Migration

• Generally Available: BYON (Bring Your Own NIC) in Azure Site Recovery
  Azure Site Recovery’s BYON feature lets users attach their own pre-provisioned NICs to maintain exact network settings during test-failover and production failover scenarios.

🌐 Networking

• Generally Available: Summarized advertised gateway prefixes for route advertisement
  The new Azure feature lets you advertise summarized gateway prefixes instead of individual VNets, simplifying routing configurations and reducing address space exposure.
• Public Preview: Ipv6 support in Azure Firewall
  Azure Firewall’s public preview introduces IPv6 support, allowing dual-stack configuration for seamless IPv4 and IPv6 traffic management with native network-rule filtering and DNS Proxy capabilities.
• Azure DNS introduces Traffic Manager linked records (Public Preview)
  Azure DNS's new Traffic Manager linked records enable direct association of DNS record sets with profiles, enhancing security, performance, and simplifying global traffic management across Azure, hybrid, and multi-cloud setups.

🔐 Security

• Smarter signals, broader coverage: UEBA anomalies on top of Behaviors layer and new data sources
  Microsoft Sentinel's Behaviors layer now integrates UEBA anomaly intelligence and supports additional data sources like Fortinet, network, and cloud logs, enhancing analyst understanding and detection of suspicious activity.
• Automatic Attack Disruption with Liz Tesch
  Liz Tesch describes how Microsoft Defender’s Automatic Attack Disruption and Predictive Shielding employ real-time account locking, access restrictions, and AI-driven measures to mitigate threats instantly upon detection.
• Power Automate | Getting Secrets Out of Your Flows with Azure Key Vault
  Power Automate now securely retrieves OAuth client secrets from Azure Key Vault instead of storing them as plaintext environment variables, reducing risk across solution exports, run history, source control, and backups.
• Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026
  Microsoft is renowned for its visionary leadership in cloud workload protection through Defender for Cloud's unified framework integrating infrastructure, workloads, identities, entitlements, data, and applications to meet the demand for comprehensive runtime visibility and protection.
• How Azure Arc allows a DB admin to become SQL Server sysadmin – the vulnerability explained
  Azure Arc's management workflow can be exploited via a database-level DDL trigger and elevated Azure identity to grant attackers full sysadmin privileges on an entire SQL Server instance, enabling complete server compromise.
• Support NIS2 with Azure Arc‑Enabled Windows Servers and Azure Resource Graph Explorer
  Azure Arc-Enabled Windows Servers integrated with Azure Resource Graph Explorer provides unified management, inventory, compliance, and automation across server environments, meeting NIS2 requirements via real-time policy enforcement and audits.

📦 Storage

• Your Azure Backups Don’t Have to Be Complicated!
  Azure Backup now integrates seamlessly with Azure Resiliency, offering unified protection for both cloud and hybrid workloads while simplifying agent management through built-in extensions.

🔗 Web

• Generally Available: Managed Instance on Azure App Service
  Managed Instance on Azure App Service simplifies migration by allowing web apps to transition with virtually no configuration or coding adjustments, supporting both on-premises and VM deployments.
• Use Aspire to implement and deploy the BFF security architecture
  Aspire orchestrates the AppHost configuration to manage Auth0 identity providers, Angular frontends, and downstream APIs within a unified BFF security architecture.
• Announcing General Availability of Managed Instance on Azure App Service
  Managed Instance on Azure App Service now provides a 99.95% production SLA, expanded regional availability in eight locations, and enhanced integration with Premium v4 features, simplifying enterprise migration of legacy .NET Framework applications with minimal code modifications.
• Azure Static Web Apps Login Redirects: How to Stop It
  Azure Static Web Apps may enter an infinite login redirect loop due to misconfigurations like passing OAuth parameters or using internal rewrite rules, requiring the app to run on Standard SKU with correct redirect URIs, enabled ID tokens in Entra ID, and avoiding custom `loginParameters` while setting explicit redirects.