Azure Weekly

Issue 575

16^th August 2026

Highlights this week in include:

• Azure Container Apps Sandboxes (Preview): Giving AI Agents a Safe Place to Work by Jan Kalis - Azure Container Apps Sandboxes offer secure, isolated environments for running untrusted AI code with features like snapshots, egress controls, managed identities, and virtual network integration, successfully deployed in production by Templafy.
• Noise Reduction with What-If Results for Deployment Stacks by Stanislav Zhelyazkov - Azure introduces a What-If engine in deployment stacks that cuts down on misleading ARM change previews, simplifying the identification of actual infrastructure modifications.
• Building an Azure AI Landing Zone Without Slowing Teams Down by Thomas Thornton - Azure AI Landing Zone introduces a unified platform pattern that standardizes identity, budgets, data governance, and security across multiple teams using model endpoints in Foundry or Azure OpenAI.
• Introducing Microsoft IQ Live: A New Biweekly Series for Developers by Ayca Bas - Microsoft IQ Live introduces a biweekly developer series covering multi-IQ architectures, serverless knowledge bases, productivity data integration, web intelligence, knowledge composition, and production governance across eight sessions starting August 6.
• Optimising DAX: Practical Examples by Carmel Eve - The article shows how small DAX tweaks, such as using bitmap filters instead of table scans, greatly boost Power BI model performance while offering advice on preventing duplicate data evaluations and reducing slicer costs.

🤖 AI

• How to Work with On-Premises AI Models to Generate T-SQL Code
  This article guides how to work with on-premises AI models using Ollama to generate T-SQL code, covering installation, model selection, hardware requirements, and practical examples.
• Introducing Microsoft IQ Live: A New Biweekly Series for Developers
  Microsoft IQ Live introduces a biweekly developer series covering multi-IQ architectures, serverless knowledge bases, productivity data integration, web intelligence, knowledge composition, and production governance across eight sessions starting August 6.
• Vector search finds candidates. Reranking decides what your RAG app reads
  This article shows how retrieval, reranking, and rank fusion stages differ using four Azure services on SQuAD, illustrating shifts in passage ranking from semantic similarity to user relevance.
• Same Agent, Two Architectures: When MCP Wins (and When It Doesn't)
  The Workbench shows that a connector agent using only GitHub data answers code issue questions well but misses broader project health metrics, underscoring the limits of single-source agents versus those integrating multiple data sources.
• From Azure Container Apps to Microsoft Foundry: building and evaluating a Patch Tuesday MCP server
  The open-source patch-tuesday-mcp project links AI assistants with real-time Patch Tuesday security data to automate update prioritization using Azure Container Apps and Microsoft Foundry.
• How MVPs Use AI - Loop engineering: Building safer AI agent workflows for high-stakes infrastructure
  Rafael Ferreira, an Azure MVP, explains how loop engineering ensures safety in high-stakes infrastructure workflows by integrating lightweight verification gates, restricting tools to separate writers from checkers, and applying explicit risk-ordered checks.
• Building Autonomous Agents with Microsoft Agent Framework and GitHub Copilot SDK Part 2/5
  The article shows how combining the Microsoft Agent Framework with GitHub Copilot SDK allows building autonomous fiber outage response agents using specialized tools and typed Python functions for reliable, scalable system prompts.
• Set up OpenwebUI on Docker with Foundry and Entra ID Authentication (Caddy)
  Setting up OpenWebUI on Docker with Foundry for inferencing and Entra ID authentication enables secure, high-performance GenAI chat solutions using Caddy as a reverse proxy and PostgreSQL for vector storage.
• Azure Content Understanding announces Synchronous Operations
  Azure Content Understanding offers real-time synchronous Read, Layout, and Digital Parse operations for immediate content extraction from images and documents without using temporary service-side storage, essential for low-latency AI workflows and secure document processing.
• Specula: Scaling formal specifications for autonomous model checking of system code
  Specula automates bug detection by generating and validating TLA+ specs for up to 48 open-source systems, discovering 207 new bugs across seven languages within ten hours at minimal cost.
• Using Azure AI Foundry resource for .NET Azure.AI.TextAnalytics and Azure.AI.Translation.Text Clients
  This article demonstrates how to consolidate .NET applications using Azure AI Language and Translator clients under a single Azure AI Foundry resource, simplifying management and reducing complexity.
• MAI-Thinking-1 – First Look
  MAI-Thinking-1 provides adaptive thinking efficiency with a 256K context window and excels in math and coding benchmarks, focusing on clear enterprise data provenance.
• When AI Agents Fail: Engineering Reliable Recovery with Microsoft Foundry
  When AI agents fail, defining clear failure semantics for each side-effecting tool call is crucial to ensure reliability in production, as shown by the procurement request example in Microsoft Foundry.
• Copilot Notebooks now works with Markdown, plain-text, and rich-text files
  Copilot Notebooks now supports Markdown, plain-text, and rich-text files allowing integration of READMEs, wikis, logs, transcripts, and other project documentation for generating insights and artifacts.
• MCP Community Connect: Bringing the MCP ecosystem together
  MCP Community Connect educates developers on using the Model Context Protocol for server building, security, enterprise deployment, and AI agent evaluation.
• Microsoft Agent Framework and Foundry
  The Microsoft Agent Framework develops AI agent tools with NLP, and Foundry offers a managed platform to deploy and scale these agents, forming a robust ecosystem for agentic applications.
• Updates to GPT-chat-latest in Microsoft Foundry
  Updates to GPT-chat-latest in Microsoft Foundry provide more focused, factual, and reliable responses while maintaining consistent behavior without needing developers to change model endpoints, enhancing conversational apps with advanced NLP.
• Running Hosted Agents in Microsoft Foundry Agent Service Part 3/5
  Running Hosted Agents in Microsoft Foundry Agent Service Part 3/5 explains how to package, deploy, and optimize agents using the Agent Optimizer and Routines for efficient production workflows.

🔎 Analytics

• Announcing: Microsoft Fabric Item Recovery will be enabled by default for tenants without an explicit setting
  Starting August 23, 2026, new Azure Synapse (Fabric) tenants will automatically receive Item Recovery with a three-day retention period, simplifying data protection for unconfigured accounts.
• Announcing: Azure Databricks Runtime 10.4 LTS will reach end of life on November 1, 2026
  Azure Databricks Runtime 10.4 LTS officially ends support and life on November 1, 2026, meaning users must migrate to a newer runtime version after March 18, 2025.
• Optimising DAX: Data Materialisation
  Data materialisation in DAX happens when the storage engine can't preprocess data, causing slow queries from expensive reconstruction, decompression, and inefficient memory use before reaching the formula engine.
• How to use the Power BI Desktop Bridge to automate tasks in Power BI Desktop and GitHub Copilot
  The Power BI Desktop Bridge lets AI agents directly edit PBIP reports and models in Power BI Desktop, integrating with GitHub Copilot for automation and providing governance through agent hooks.
• Optimising DAX: Practical Examples
  The article shows how small DAX tweaks, such as using bitmap filters instead of table scans, greatly boost Power BI model performance while offering advice on preventing duplicate data evaluations and reducing slicer costs.

🖥️ Compute

• Add AI to the workflows you already have using Serverless Agents in Azure Functions
  Azure Functions now supports non-HTTP triggers allowing seamless integration of Serverless Agents for adding AI capabilities to existing deterministic workflows such as expense processing pipelines without rewriting core components.
• From Silicon to Systems: Bending the Cost and Complexity Curves of AI
  Microsoft integrates AI models, software, and custom silicon (Maia 200, Azure Cobalt 200) to optimize costs and complexity for agentic AI workloads.

🚢 Containers

• Generally Available: Control plane metrics collection for AKS with Managed Prometheus
  Azure Kubernetes Service now provides general availability of Control Plane metrics collection with Managed Prometheus for native observability into key control plane components via Azure Monitor.
• Azure Container Apps Sandboxes (Preview): Giving AI Agents a Safe Place to Work
  Azure Container Apps Sandboxes offer secure, isolated environments for running untrusted AI code with features like snapshots, egress controls, managed identities, and virtual network integration, successfully deployed in production by Templafy.
• Container Network Insights Agent (CNIA): Your AI Teammate for AKS Networking Incidents
  The Container Network Insights Agent for AKS offers an AI-powered troubleshooting tool that swiftly identifies network problems, compiles all relevant data in one chat window with suggested fixes, and works as a seamless AKS extension without modifying cluster settings.

🗄️ Databases

• Generally Available: Pre-upgrade validation checks for Azure Database for PostgreSQL Flexible Server
  The new pre-upgrade validation checks for Azure Database for PostgreSQL Flexible Server allow administrators to verify MVU readiness in advance, reducing risks and downtime during the upgrade process.
• A Better Fire Alarm Is Still a Fire
  This SQL Server audit details eight preventive checks to identify and mitigate common incidents before they occur.
• Episode 190 - SQL Server 2025 gains RDS but loses Web
  SQL Server 2025 is now available on Amazon RDS, while the discontinued Web Edition prompts a discussion on why organizations might still prefer SQL Server over PostgreSQL despite its higher cost.
• MSDB attack paths: how to secure SQL Server Agent, triggers, and restores
  This article highlights how improper configuration of routine DBA tasks such as SQL Server Agent jobs and maintenance plans can create security vulnerabilities, stressing the importance of monitoring role memberships, job ownership, and execution contexts.
• SQL Server Performance Office Hours Episode 72
  In Episode 72, Erik Darling covers SQL Server performance topics including version control for DBAs, memory pressure indicators, and query optimization techniques.
• Announcing SQL Server Management Studio (SSMS) 22.9.0
  SQL Server Management Studio 22.9.0 adds read-only Ask Mode for reviewing T-SQL scripts without executing them and enhances Agent Mode with Object Explorer integration tools.
• Building MCP servers for your database: Flexibility, safety, and tradeoffs
  Building MCP servers for databases offers flexibility and safety but requires careful design to balance agent capabilities with security constraints, especially with PostgreSQL.
• Resilient Azure Platforms: Durable Functions, Cosmos DB, and DR by Design
  Bhavana Konchada's session explains how Azure's Resilience Control Platform integrates durability across all layers, from service boundaries to Cosmos DB partitioning, ensuring system continuity despite downstream failures.
• Oracle to PostgreSQL in VS Code: Assessment, Conversion, and Validation
  The article assesses AI-assisted migration of Oracle databases to PostgreSQL via VS Code, emphasizing effort evaluation, prototype creation, and validation using Swingbench Order Entry.
• What’s next for SQL? Performance, scale, AI, and developer productivity at the European SQL Community Conference
  The European SQL Community Conference will showcase SQL Server 2025’s AI and vector search enhancements, Azure SQL Database Hyperscale for scalable AI-ready apps, and productivity tools like Database Hub, SSMS, Visual Studio Code, and GitHub Copilot.
• How to avoid nested REPLACE functions with TRANSLATE in SQL Server
  The TRANSLATE function in SQL Server simplifies character replacements by allowing multiple substitutions in a single call, improving code readability compared to other databases.
• July 2026 Recap: Azure Database for PostgreSQL
  Azure Database for PostgreSQL Flexible Server introduced PgBouncer 1.25.2 with security fixes, new REST APIs, Azure CLI enhancements, expanded availability in India South Central, and added pgPointCloud, RDKit, and plpgsql_check extensions to boost extensibility for geospatial, cheminformatics, and procedural SQL workloads.

🛠️ Developer tools

• Building API Reference Documentation From Code, Part 1: The Pipeline
  The Endjin team developed a custom documentation pipeline that auto-generates accurate API reference docs from compiled assemblies and XML comments, supports multiple engine versions with version toggles, displays framework availability badges, and integrates smoothly into CI builds using the Vellum static site generator.
• Multi-Language Support for Cross-Platform .NET
  Uno Platform 6.6 enhances cross-platform .NET app development with full IME composition, Unicode-correct text handling, and automatic font fallback for languages such as Japanese, Arabic, and Hindi.
• 🦾 From Model to Agent: let’s build our own Claw, live in C#
  This series teaches C# and .NET developers how to build a personal finance CLI assistant using the new Microsoft Agent Framework harness, covering basics to production-ready observability in four live coding sessions.
• Why the GitHub Copilot app became my daily driver
  The GitHub Copilot app enhances development by directing multiple agents across parallel workstreams, providing isolated workspaces and smooth GitHub integration, making it indispensable for handling complex projects alongside traditional IDEs.
• Using the GitHub Copilot SDK for Java
  The GitHub Copilot SDK for Java provides a framework-agnostic integration of AI into server-side Java apps using Jakarta EE and Spring, removing vendor dependence and allowing any direct model provider through BYOK.
• Microsoft Study Shows Just How 'Agentic' GitHub Copilot Has Become
  The study reveals that GitHub Copilot autonomously initiates 87% of large language model calls, often entering lengthy retry loops when faced with failures.
• Building API Reference Documentation From Code, Part 2: Under the Hood
  The tool builds a combined type URL map across all assemblies using Portable PDB metadata to enable accurate cross-assembly references and direct "View Source" links in API documentation.
• Solving bugs with elmah.io and Claude Code - a real-life example
  Using elmah.io’s MCP server with Claude Code automates bug fixing by allowing AI direct access to error details, uptime checks, and deployments in real time, streamlining workflow from Slack notifications to code adjustments.
• First steps with MAUI: some friction
  Setting up MAUI on macOS requires addressing Xcode compatibility issues and bugs like missing Tab Bars in Mac Catalyst builds by updating the workload.
• Configuration Management in Microsoft Agent Framework
  The article compares using a config.json file versus a secrets management system like the Microsoft Agent Framework, noting that while config.json is simple and version-control friendly for non-sensitive data, it poses security risks if used for sensitive information such as API keys, whereas secrets management provides robust encryption and access control for production environments.
• Today I will… manage Git Submodules without leaving the IDE
  Visual Studio 18.9 adds native Git submodule support enabling direct management within the IDE without needing a terminal.
• Agentic Skills Demystified
  Agentic Skills provide prescriptive context to AI Agents working in .NET tooling, turning raw model power into actionable code by encapsulating team conventions and best practices.
• VS Code 1.133 Flexes Claude Sessions
  VS Code 1.133 introduces provider switching and a Claude session entry point without requiring GitHub, enhancing AI integration flexibility.
• Launch: T-SQL Analyzer live analysis now in VS Code
  The T-SQL Analyzer now offers live syntax checking directly in Visual Studio Code, highlighting design, naming, and performance issues as you type with 140+ built-in rules and customizable settings.
• Write your first prompt with the GitHub Copilot app
  Starting with simple plain-English descriptions, you can quickly generate code changes in the GitHub Copilot app without mastering special syntax or choosing complex models.
• Governing a Risk Operations Agent with the Microsoft Agent Framework Harness and AGT
  The article demonstrates using the Microsoft Agent Framework Harness with AGT to permit only listing, reading, and searching files while restricting creating, deleting, or overwriting them, logging all decisions in an audit trail.
• Introducing Fisher: Sqlite Backed Document Db & Event Store Critter
  Fisher is an SQLite-based document DB and event store for .NET, integrating seamlessly with Marten and Polecat APIs for use in database-less applications like desktop, edge, and embedded services.
• Explore What’s New in SkiaSharp 4.0
  SkiaSharp 4.0, co-maintained by Uno Platform and Microsoft, introduces a newer rendering engine, cleaner API, and up to 30% faster performance for .NET apps across all platforms.
• Using the Wolverine “Side Effect” Model to Simplify Code
  Using Wolverine’s “Side Effect” model simplifies code by decoupling audit logging and other side effects, reducing dependencies like HttpContext and improving testability.
• TypeDeclaration: An Abstraction for Understanding JSON Schema
  TypeDeclaration abstracts JSON Schema into high-level code patterns for generating consistent C# models and powers a Blazor schema explorer.

🔩 DevOps

• From coder to orchestrator: How agents shift the role of a developer
  GitHub Copilot turns developers into orchestrators by integrating AI agents into CI workflows, enabling trigger definition, permission scoping, and task handoff management with human oversight for high-risk activities.
• August Patches for Azure DevOps Server
  The August patches for Azure DevOps Server and its 2022.2 edition address critical security vulnerabilities and performance improvements, with release notes detailing each change.
• Application Insights: Catch Failures Before Customers Do
  Azure Application Insights detects potential failures in advance by analyzing telemetry data with Kusto Query Language (KQL) and setting up proactive alerts.
• Azure DevOps Boards: Trace Every Commit to Deployment
  Azure DevOps Boards lets you map each commit directly through work items and deployments, ensuring full traceability from code changes to production releases.
• Understanding GitHub Billing and management: from licenses to fair AI credit controls
  Understanding GitHub Billing and management is crucial for separating seat assignment, cost centers, AI credit caps, budgeting layers, and user-level limits to prevent confusion between controls addressing different governance questions for Copilot licenses.
• Building an Azure AI Landing Zone Without Slowing Teams Down
  Azure AI Landing Zone introduces a unified platform pattern that standardizes identity, budgets, data governance, and security across multiple teams using model endpoints in Foundry or Azure OpenAI.
• Your contributors are AI-first now. Is your project?
  AutoGPT demonstrates integrating AI contributions via scoped AGENTS.md files, dynamic skill discovery, and automated gates such as PR templates, test plans, and CI coverage thresholds to maintain relevance and documentation quality.
• GitHub availability report: July 2026
  The July 2026 report highlights an Actions outage emphasizing the need for better isolation and resiliency, leading to a quicker move of GitHub Actions to Azure for improved capacity and reduced failure impact.
• Monitoring Azure Service Fabric with Azure Managed Grafana
  Monitoring Azure Service Fabric with Azure Managed Grafana offers a unified operational view by visualizing telemetry from Azure Monitor Agent and Log Analytics, improving visibility across cluster nodes, VM infrastructure, and Service Fabric events without replacing native tools.
• How to bring your software delivery workflow into GitHub with agent apps
  GitHub agent apps integrate tools like Amplitude, Endor Labs, LaunchDarkly, and PagerDuty into the GitHub workflow for contextually answering critical questions about software delivery such as impact analysis, dependency health, rollout safety, and deployment readiness directly in pull requests.

🧬 Hybrid + multicloud

• Join the Azure Arc Customer & Engineering Forum for Windows Server
  The Azure Arc Customer & Engineering Forum for Windows Server provides a platform to engage directly with engineering teams for discussing new management features, best practices, and shaping future product development.

🎭 Identity

• Microsoft Entra Tenant Governance is now generally available
  Microsoft Entra Tenant Governance centralizes control over multi-tenant environments, reducing security risks and enabling consistent policy enforcement across related tenants.
• What's New in Microsoft Entra: August 2026
  The August 2026 update to Microsoft Entra introduces admin control for automatic SSO prompts on Windows devices, enables Exchange Online-managed attribute writeback to Active Directory, and adds new lifecycle workflow features like what-if simulation and user attribute updates.
• Secret’s out: How to replace client secrets with Azure managed identity
  Azure managed identity replaces client secrets for Azure-hosted apps, automating credential management while maintaining role-based authorization through Microsoft Entra ID.
• Are Microsoft preparing license enforcement for Entra ID?
  Microsoft may be gearing up to enforce license compliance in Entra ID, as indicated by recent subscription warning messages for Conditional Access features.
• Microsoft Graph Atlas MCP Server
  The Microsoft Graph Atlas MCP Server offers AI assistants real-time visibility into documented and undocumented changes across Entra ID, Governance, IAM, Agent ID, and Information Protection surfaces, along with an interactive schema visualizer.
• How to enforce Zero Trust across every resource
  Enforcing Zero Trust requires report-only policies, emergency access exclusions, phased rollouts, and tools like Conditional Access and Global Secure Access for enhanced security.
• Why Active Directory alone is no longer enough
  Active Directory's limitations, including increased complexity and slower adoption of cloud and AI, are driving organizations toward more flexible identity platforms.
• Microsoft Entra agent users can join your dynamic groups. Here is what to check
  Understanding how agent user accounts are evaluated by dynamic membership rules in Entra ID is crucial because they can inherit permissions and licenses if their properties meet the group’s criteria.
• Is It Safe to Enable Preview Features in Your Production Tenant?
  Enabling preview features in production tenants can lead to instability due to short notice retirements, highlighting the risk of treating them as permanent dependencies.

🔌 Integration

• What the New API Management AI Gateway Tier Changes for App Service-Hosted Agents
  The new AI Gateway tier in Azure API Management separates model and tool access from App Service, offering an AI-focused resource, portal, and runtime experience without changing the application runtime or orchestration duties.
• Introducing dependency telemetry in Application Insights for Azure API Management policies
  Azure adds external dependency telemetry to Application Insights for major API Management policies, helping operators identify latency causes from policy-fanout calls, retries, and backend interactions.
• Azure Service Bus: One topic, many subscriptions
  Azure Service Bus demonstrates that a single shared topic can become a performance bottleneck with many subscriptions and filters, emphasizing the simplicity vs. scalability trade-off in pub/sub architectures.
• Closing the SQL Data Sync Monitoring Gap: Building Proactive Alerts with Azure Logic Apps
  This solution builds proactive alerts with Azure Logic Apps to monitor and notify teams of SQL Data Sync warnings and errors before they impact business applications.

💡 Internet of Things

• Announcing new security enhancements across Azure IoT services
  Azure IoT services now offer enhanced security features such as TLS 1.3 support, managed identity authentication for Hub linking to DPS, and encrypted update delivery via TLS downloads in Device Update for IoT Hub to strengthen protection across connected devices and fleets.
• Direct IoT Hub-to-Fabric message routing, with context preserved via CloudEvents, in Public Preview
  Direct IoT Hub-to-Fabric message routing preserves operational context using CloudEvents for real-time analytics and seamless integration while maintaining device identifiers and timestamps.

🎓 Learning and Certifications

• Build the right skills faster with the AI Agent
  The AI Agent personalizes training recommendations, answers questions, and creates customized skilling plans based on user roles and goals in the Microsoft Partner Skilling Hub.
• SQLCon is Back: 5 Reasons to Attend the European Microsoft Fabric + SQL Community Conference
  Attend SQLCon Europe in Barcelona to enjoy over 130 sessions, specialized tracks for DBAs and developers, and updates on SQL Server 2025, Azure SQL, and Fabric.
• Build an Azure Home Lab for Certs Without Overspending
  Create a cost-effective Azure Home Lab using Hyper-V, complete with a domain controller and Azure Arc, tailored to prepare for AZ-900, AZ-104, and AZ-305 certification exams.
• Your guide to GitHub Universe 2026 is here: The schedule just launched!
  GitHub Universe 2026 will feature expert-led sessions on AI-powered development, Copilot configuration, and enterprise-scale AI measurement from companies like AMD, Figma, NVIDIA, Coinbase, Anthropic, and OpenAI.

⚖️ Management and Governance

• Auditing Microsoft 365 Copilot: What's Logged, Where to Find It, and How Long It's Kept
  Auditing in Azure DevOps shows detailed build and release activity logs accessible via Azure Monitor, with retention policies configurable up to one year for compliance needs.
• Operating Azure Backup at Scale: Day-2 Excellence for IaaS, PaaS, and Storage Workloads
  Azure Backup provides a unified vault model for IaaS, PaaS, AKS, PostgreSQL flexible servers, and storage workloads with consistent policies, cyber resiliency features such as immutability and soft delete, and threat detection previews to enhance ransomware protection.
• Reliability Starter Kit: SLIs, Health models, and SRE Agent
  The Reliability Starter Kit shows how Azure Monitor, SLIs, SLOs, and the Azure SRE Agent collaborate to convert resource metrics into actionable insights for on-call engineers, facilitating swift incident response during a simulated e-commerce checkout failure.
• Azure Policy Definition to Enforce IaC and Restrict Click Ops
  The new Azure Policy definition denies manual ARM API requests, requiring changes to be made via signed-in service principals and Infrastructure as Code deployments.
• Azure Monitor Auxiliary Logs expands with Azure tables support, plan switching, and sovereign clouds
  Azure Monitor now supports Azure table logs on the Auxiliary plan, enables flexible plan switching between Analytics and Auxiliary plans, and expands availability to Azure Government and 21Vianet clouds for easier high-volume low-touch data adoption.
• The Economics of Agent Optimization: From pilots to measurable returns
  This four-part series explains how teams can convert AI pilot investments into measurable returns using cost management techniques in application-level visibility, workflow design, and platform-integrated controls within Microsoft Foundry.
• Designing User-Centred Reliability with Azure Monitor SLIs and the Azure SRE Agent
  Azure Monitor SLIs with the Azure SRE Agent link service metrics to operational choices, providing actionable insights for teams and leaders.
• Azure Monitor SLIs on Managed Prometheus: the bits the docs don't tell you
  Azure Monitor’s native SLIs and SLOs with Managed Prometheus require using the metric namespace `customdefault` instead of `prometheus`, as documented examples often omit this critical detail, leading to common provisioning errors if missed.
• Deploy Azure Monitor SLI Alerting as Code
  Deploy Azure Monitor SLI alerting as code by creating metricAlert resources using SLI emitted metrics for baseline and burn-rate alerts, overcoming the `enableAlert` limitation.
• From Features to Flow: How Real-World Adoption Reshaped the Azure Architecture Diagram Builder
  The Azure Architecture Diagram Builder evolved into a four-stage guided workflow-Create, Refine, Validate & Improve, and Share or Build-to assist users in initiating projects, preserving work, validating responsibly, and sharing results.
• Noise Reduction with What-If Results for Deployment Stacks
  Azure introduces a What-If engine in deployment stacks that cuts down on misleading ARM change previews, simplifying the identification of actual infrastructure modifications.
• Are we locked in the Cloud?
  Practical considerations such as stability, security, and cost generally outweigh debates over US government access to cloud data under the Cloud Act when assessing if businesses should stay with major US cloud providers.

🌐 Networking

• Generally Available: 2.2X IDPS performance optimization in Azure Firewall
  Azure Firewall’s new 2.2× IDPS performance optimization boosts throughput to 22 Gbps and doubles the per-connection IDPS capacity to 600 Mbps, significantly enhancing security inspection capabilities.
• Generally Available: Batch rule updates for Azure Front Door
  Azure Front Door now offers batch rule updates, allowing users to simultaneously add, modify, delete, or reposition multiple rules within a single operation for smoother configuration management.
• Public Preview: Azure Front Door mutual TLS
  Azure Front Door’s public preview introduces mutual TLS, allowing applications to verify client identities with X.509 certificates, enhancing security for B2B integrations and internal APIs.
• Azure Route Server route maps: more than a feature
  Azure Route Server’s new route maps introduce significant changes to its operation, requiring connection modeling and potentially breaking existing functionality like VNet-to-VNet IPsec peers.
• The square design with hub-and-spoke
  The square hub-and-spoke design optimizes costs in ExpressRoute but increases complexity and latency during failures, necessitating advanced BGP manipulations and ARS tools for resilience.
• Azure SRE Agent for Networking
  The Azure SRE Agent resolves an OSPF area mismatch issue in a simulated networking environment with containerlab and FRR routers, showcasing its autonomous handling of complex infrastructure challenges.

🔐 Security

• Retirement: Containerized data connector agent for the Microsoft Sentinel solution for SAP applications
  SAP organizations need to switch to another logging method by September 14, 2026, as the containerized data connector agent will retire and stop sending logs to Microsoft Sentinel.
• Implement BFF using Auth0, Angular and ASP.NET Core
  This article shows how to implement a BFF architecture with Auth0, Angular, and ASP.NET Core using OpenID Connect, OAuth, and DPoP for secure auth and authorization.
• Thunderstruck in Microsoft Defender XDR
  Thunderstruck in Microsoft Defender XDR shows how to merge process and network telemetry with KQL to build a reusable filtered dataset, assign transparent risk scores, and highlight unusual scripting activity, blending technical guidance with personal interests in metal music and dynamic query languages.
• DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
  DeadLock ransomware employs a Rust-based encryptor and decentralized recovery via blockchain, affecting over 80 global organizations since July 2025 while using language and geofencing to evade certain regions.
• Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise
  Microsoft Defender Experts MDR earns its Leader designation in the 2026 IDC MarketScape by combining round-the-clock human expertise with native integration on the Microsoft Defender platform, delivering continuous detection improvements and leveraging over 100 trillion daily signals from global threat intelligence to achieve high-confidence incident response.
• INFO: State & Local Government Regulatory Compliance across Microsoft cloud service offerings
  The article details how Microsoft classifies its cloud services to meet US state and local government regulatory requirements, covering regulations such as FBI CJIS, IRS Tax 1075, FedRAMP Mod/High, and NERC/CIP.
• Security-First Performance Testing: A Cloud-Native Approach with JMeter and Azure Load Testing
  Azure Load Testing integrates with Azure Key Vault to securely manage JMeter credentials, eliminating plaintext storage risks while maintaining performance and compliance.
• Migrate Splunk to Sentinel Without Losing Detection Coverage
  The migration playbook ensures detection coverage is maintained by auditing Splunk rules, converting them to KQL in Sentinel, and validating performance before full cutover.
• Ctrl+Alt+Azure - Episode 355 - Microsoft Tech Updates
  This week's tech updates include new Azure Entra Backup and Recovery features, improved Conditional Access policies, Project Perception launch, and previews of AI Gateway in APIM and sensitive telemetry protection in Application Insights.
• Enable API Security Posture Management with Defender CSPM
  Defender CSPM’s API security posture management reveals hidden APIs from function endpoints, Logic Apps, and cloud-native paths, turning findings into actionable remediation tasks for Azure services.
• Episode 434: Reading the Spec Sheet on Microsoft’s Agentic SOC
  Episode 434 explores Project Perception, revealing that it requires six agents and seven playbooks, each manually triggered with its own Entra Agent ID for tenant integration.
• What 50 open source projects taught us about security in the AI era
  The GitHub Secure Open Source Fund’s latest session showed that AI tools can accelerate incident response for maintainers while emphasizing the ongoing need for human judgment in security decisions.
• Threat Modeling and Post Quantum Cryptography
  Threat modeling uncovers hidden cryptographic dependencies crucial for migrating to post-quantum cryptography.
• Empower Real-Time Security with Microsoft Sentinel’s CCF Push Feature
  The new CCF Push feature in Microsoft Sentinel enables real-time, automated delivery of security data directly to the platform, reducing response times for threats from hours to immediate action.
• Accelerate connectors development using AI agent in Microsoft Sentinel
  The new AI-assisted VS Code extension for Azure Sentinel streamlines connector creation with low-code prompts and guided workflows, reducing development time by integrating schema management, validation, testing, and deployment into a single toolchain.
• Building Microsoft Sentinel Connectors in Minutes with the Sentinel Connector Builder Agent
  The Sentinel Connector Builder Agent quickly creates codeless pull connectors for Azure Functions APIs in minutes, automating artifact generation and deployment to Microsoft Sentinel via a conversational VS Code workflow.

📦 Storage

• Generally Available: Live Resize for Shared Premium SSD v2 and Ultra Data Disks
  Live Resize now enables dynamic expansion of Shared Premium SSD v2 and Ultra Data Disks, allowing seamless application upgrades with minimal downtime.
• Accelerate Inference on AKS with Azure Blob Storage and NVIDIA Dynamo
  Azure Blob Storage integrates with NVIDIA Dynamo to boost AI model cold starts, speeding up weight loading by up to 4.6× and reducing time-to-first-token latency by 2.8× on Azure Kubernetes Service.

🔗 Web

• Public Preview: Markdown for Agents in Azure App Service
  The public preview allows AI agents in Azure App Service to directly access and render Markdown content from apps, enhancing readability and tool integration.
• A simpler way to deploy ZIP packages to Azure App Service from the Azure portal
  Azure's Deployment Center streamlines uploading ZIP packages to Azure App Service for Linux, allowing previewing, building, and monitoring deployments within the portal.
• Entra SSO for an Azure Static Web App
  Entra SSO for Azure Static Web Apps allows authentication to limit site access to designated tenant groups through staticwebapp.config.json, environment variables, and route configurations.