Azure Feeds

Azure Virtual Network Routing Appliance: peering performance, hub-and-spoke control

Mon, 21 Sep 2026 20:06:37 +0000

Yet another routing appliance? The name of this new Azure service is confusing. Is it a sort of NVA? A new kind of routing engine? No, the name tells too little, you need to look at the problem it solves. When two applications in different VNets need to talk, you have two options. The first is VNet peering. Throughput and latency are excellent: traffic stays on the Azure backbone, and VMs behave as if they were on the same network. But peering isn't transitive. With more VNETs that need to talk to each other means peerings. Difficult to control and manage at scale. The second is to route through a central device in a hub: Azure Firewall, a third-party NVA, or even your on-premises network. You get central control and visibility, but every flow now depends on the capacity of that device. It becomes the bottleneck. A NVA will be blocked by the VMs capacity, Azure Firewall can manage up to 100 Gbps but you will have to pay the price. Most companies chose the second option and accepted the performance hit in exchange for more governance. But this trade-off become harder to defend when workloads move large volumes of data between VNETs: data pipelines, centralized databases, AI workloads reading from storage in another landing zone, agents calling APIs across the Azure tenant. The Azure Virtual Network Routing Appliance is between the two options. It's an Azure-managed forwarding layer that you deploy in your hub (or any central VNETs, you don't need a gateway to make it work). It runs on dedicated networking hardware, directly inside the Azure Backbone, and comes in 10, 50, 100 or 200 Gbps tiers. VNETs route through it the way they would through an NVA, without the NVA bottleneck. It is not a firewall. It doesn't inspect traffic. Control comes from the Azure-native tools around it: UDRs, NSGsand Azure Monitor metrics. If controlling flows is needed, keep your firewall in the path for those flows. Deploying it takes three steps. First, register the feature on your subscription: Register-AzProviderFeature -FeatureName AllowVirtualNetworkAppliance – ProviderNamespace Microsoft.Network The second step is to create a virtual network (or use an existing one) with a dedicated subnet, named VirtualNetworkApplianceSubnet. resource hubVnet 'Microsoft.Network/virtualNetworks@2024-05-01' = { name: 'hub-vnet' location: location properties: { addressSpace: { addressPrefixes: [ 10.0.0.0/21 ] } subnets: [ { name:VirtualNetworkApplianceSubnet properties: { addressPrefix: 10.0.0.0/24 } } ] } } Then we can deploy the Virtual Network Routing Appliance. resource routingAppliance 'Microsoft.Network/virtualNetworkAppliances@2025-07-01' = { name: 'vnra-test' location: location properties: { bandwidthInGbps: 10 privateIPAddressVersion: 'IPv4' subnet: { id: '${hubVnet.id}/subnets/VirtualNetworkApplianceSubnet' } } } Once it's deployed, the portal view is nearly empty. There's nothing to configure beyond the properties. The interesting part is the Metrics blade. Bytes, packets and flows, inbound and outbound, are available out of the box, with no diagnostic settings to configure. That's your visibility on east-west traffic. With PowerShell, Get-AzVirtualNetworkAppliance gives you a bit more detail. In the IP configuration you'll see several ipconfig_4_xxxx entries, a hint that more than one instance sits behind the single private IP you route to So how do spokes VNETs can use it? First, each spoke need a peering with the hub VNET. And, make sure that spoke VNETs are not peered with each other. Peering alone isn't enough. Every spoke subnet that should use the appliance needs a UDR pointing to the appliance's private IP as next hop: resource spokeRouteTables 'Microsoft.Network/routeTables@2024-05-01' = name: 'vnra-to-other-spoke-rt' location: location properties: { disableBgpRoutePropagation: false routes: { name: 'to-appliance-10-2-0-0_16' properties: { addressPrefix: 10.2.0.0/16 nextHopType: 'VirtualAppliance' nextHopIpAddress: 10.0.0.4 } } } } Apply the route tables on both sides. With that in place, workloads in two spokes that aren't peered together can talk through the hub, at close to peering performance. After these operations you should have this architecture. You can also send 0.0.0.0/0 to the appliance so every spoke gets the same route table. The appliance doesn't NAT, so internet traffic still needs a next hop that does, configured on the appliance subnet. And check the return path, especially for Private Endpoint traffic. The simplest design is still RFC1918 to the appliance and the default route to your firewall. The service went GA in August 2026, so several preview restriction are gone: IPv6 and dual-stack are supported, and the region list has grown. A few limits remain: Two appliances per region per subscription. Bandwidth is fixed at creation. To change it, you need to delete and redeploy the appliance. VNET flow logs is not supported yet. Terraform needs the AzAPI provider; AzureRM doesn't support it. Traffic through the appliance isn't covered by VNET encryption. The Virtual Network Routing Appliance doesn't replace your firewall. It removes the reason your firewall was doing routing in the first place. If your hub firewall today spends most of its time forwarding east-west traffic, this is worth a look: send private traffic through VNRA, and keep the firewall for the flows that actually need inspection.

[Launched] Generally Available: Azure Sphere OS version 26.09 is now available

Mon, 21 Sep 2026 18:44:49 +0000

Azure Sphere OS version 26.09 is now available

Mon, 21 Sep 2026 17:18:56 +0000

Azure Sphere OS version 26.09 is now available in the Retail feed. This release includes updates to the Azure Sphere OS only, with no update to the SDK. If your devices are connected to the internet, they will receive the updated OS from the cloud. The 26.09 OS Retail release migrates the underlying Azure Sphere OS Linux Kernel version from the 5.10 to 6.1 branch, aligning Azure Sphere with the Linux CIP Platform for Super Long-Term Support. This will be Azure Sphere's final major kernel update prior to retirement in 2031. Please note that there are no functional changes or new features in this release. For self-help inquiries or technical support, review the Azure Sphere support options .

Microsoft.Data.SqlClient 7.1.0 is now generally available

Mon, 21 Sep 2026 17:00:00 +0000

This release is about making everyday database workloads more predictable. It fixes a collection of issues that could appear under connection failures, retries, transactions, pooling, streaming, encryption, and newer SQL Server data types. If your application uses Microsoft.Data.SqlClient, upgrading to 7.1.0 gives you a provider with fewer sharp edges in the paths your application already depends on. Connections and transactions behave more reliably Connection pooling is one of those features that should disappear into the background. Your application opens a connection, does its work, returns the connection, and moves on. SqlClient 7.1.0 fixes several cases where that process could go wrong: A connection could return to the pool in a broken state after a TransactionScope rollback. Pool performance counters could become negative or drift upward after failed or broken connections. A connection factory timer could keep waking the process even when there were no pools to maintain. A race during connection opening could produce an InvalidCastException. Failover login paths could encounter invalid parser state. Several cancellation token sources could remain allocated longer than necessary. These fixes matter most in long-running services, applications that reconnect frequently, and workloads that depend heavily on pooling and transactions. Better behavior for modern SQL Server data SqlClient 7.1.0 also fixes issues that affect newer .NET and SQL Server scenarios. Applications using DateOnly with variants or table-valued parameters now send the correct SQL type. This avoids converting valid date values into datetime and prevents failures for dates outside the datetime range. Large decimal parameters with explicit precision and scale no longer cause an OverflowException. This is especially important for Always Encrypted applications, where precision and scale are commonly specified explicitly. Azure SQL applications using schema discovery can now see the json data type through: connection.GetSchema("DataTypes"); The release also corrects Always Encrypted metadata reads and fixes a SqlDataReader streaming issue where calling IsDBNull() before reading a streamed value could skip data. Easier diagnosis for libraries and tools SqlClient 7.1.0 adds an application identity to the TDS USERAGENT payload. Most application developers do not need to configure this. The feature is intended for libraries and tools built on top of SqlClient. For example, Entity Framework Core, SQL Server Management Studio, SqlPackage, and other tools can identify themselves to SQL Server. That gives database and service operators a clearer picture when investigating a workload. Instead of seeing only that many connections came from SqlClient, telemetry can show which client stack created them. A library or tool can register its identity before opening a connection: using Microsoft.Data.SqlClient; await using var connection = new SqlConnection(connectionString); connection.RegisteredApplication = RegisteredApplication.EntityFrameworkCore; await connection.OpenAsync(); This value is telemetry only. It must not be used for authorization or other security decisions. Moving away from Transparent Network IP Resolution TransparentNetworkIPResolution is now marked obsolete. There is no runtime behavior change in 7.1.0. Applications that use the property will receive a compile-time warning and can migrate when convenient. For new code, use MultiSubnetFailover, which works across supported target frameworks and is the recommended approach for availability group listeners. Upgrade to 7.1.0 Install the provider with NuGet: dotnet add package Microsoft.Data.SqlClient --version 7.1.0 The SqlClient extension packages continue to use aligned versions. If your application references them, update them to 7.1.0 too: Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider Microsoft.Data.SqlClient.Extensions.Azure Microsoft.Data.SqlClient.Extensions.Abstractions Microsoft.Data.SqlClient.Internal.Logging Applications upgrading from 7.0.2, 7.0.3, or a 7.1 preview do not need new .NET Framework strong-name binding redirects. Read the complete 7.1.0 release notes and get the package from NuGet . The revised social posts should focus on “more reliable connections, transactions, pooling, encryption, and modern data types,” with application identity telemetry as one short secondary point.

[In preview] Public Preview: Introducing a Guided Copilot Experience for Building Azure Apps in VS Code

Mon, 21 Sep 2026 16:58:19 +0000

Today we're previewing a new way to build cloud apps with GitHub Copilot in VS Code: a guided Copilot experience that takes you from idea to a deployed Azure app through a structured, predictable workflow instead of a free-form chat session that may or ma

[Launched] Generally Available: Azure Functions support for PowerShell 7.6

Mon, 21 Sep 2026 16:55:34 +0000

Azure Functions support for PowerShell 7.6 is now generally available. You can now develop apps using PowerShell 7.6 locally and deploy them to Azure Functions plans. Learn more: Updating your app to PowerShell 7.6 What's new in PowerShell 7.6? Azure

Virtual nodes on Azure Container Instances: a new compute layer for AKS

Mon, 21 Sep 2026 16:44:41 +0000

Meet virtual nodes on ACI Azure Kubernetes Service (AKS) gives you managed Kubernetes: the full Kubernetes API without operating the control plane yourself. Virtual nodes on Azure Container Instances go a step further, letting your pods run directly on Azure's serverless container platform, with the elasticity and with no capacity planning and no waiting for machines. Whether you already run AKS or want a managed Kubernetes that bursts without node management, this is for you. In short: virtual nodes on ACI attach Azure's serverless container platform to your cluster as Kubernetes nodes. Pods run as Hyper-V isolated containers, sized per pod rather than packed onto a fixed VM, up to 200 pods per virtual node. Run multiple virtual nodes, scaled as replicas, for more. They behave like any other pod: same kubectl , Helm, and GitOps. Kubernetes has always assumed a fixed set of machines underneath it. That assumption shapes everything above it: you size a node pool for a specific VM type in a specific region, you plan for peak rather than for average, and every workload on a node shares the same kernel and the same security boundary. Virtual nodes on ACI relaxs that assumption, which is what makes both elastic capacity and per container isolation possible without a different Kubernetes. If you've used the original AKS virtual nodes add-on (Virtual Kubelet based), this is not a rebrand. It is a new implementation that integrates far more deeply with Kubernetes, lifts most prior limitations (init containers, persistent volumes, managed identity, richer networking), and adds confidential containers as a first-class capability. The migration guide can be found here . Two capabilities carry the rest of this post: effortless burst capacity, and confidential containers. How virtual nodes on ACI work ACI runs every container as a Hyper-V isolated container, which means each one gets its own lightweight virtual machine boundary rather than sharing a kernel with its neighbors. Azure operates that platform. A virtual node connects it to your cluster. The cluster's control plane, the component that decides where each container runs, sees two kinds of destination: a small pool of virtual machines carrying cluster services, and one or more virtual nodes. Diagram showing how a pod reaches ACI through a virtual node. From the application manifest's perspective, nothing changes. The pod lands on a virtual node; the virtual node hands it off to ACI. See Microsoft Learn: virtual nodes on ACI for the official capability and current limits. Virtual nodes on ACI in practice The rest of this post is hands on. You do not need to be a Kubernetes expert to follow it. kubectl is the command line tool for talking to a cluster, Helm installs packaged software into one, and a manifest is a text file describing what you want to run. If you have a cluster, everything below runs against it as written. The manifests behind the examples live in a companion demo repo. Setup is documented officially, and you can reproduce this end to end from the ACI virtual nodes documentation and the microsoft/virtualnodesOnAzureContainerInstances Helm repo. One requirement before you start: deploy into a delegated ACI subnet, meaning a subnet in your virtual network set aside for the ACI platform to place containers in. Size it for peak pod count plus headroom, since every pod consumes an address from it for its lifetime. Demo manifest files can be found in this repo , a personal sample repo provided as is and not a supported Microsoft artifact. Enable virtual nodes on ACI The virtual node is deployed via Helm. The Microsoft GitHub repo is itself a Helm repository, so a single helm install is all you strictly need. Cloning first, shown here, just makes it easier to customize values. Running kubectl get nodes afterward confirms the node registered. git clone https://github.com/microsoft/virtualnodesOnAzureContainerInstances.git helm install ./virtualnodesOnAzureContainerInstances/Helm/virtualnode kubectl get nodes The virtual node appears alongside any existing capacity, ready to accept work. Image 1: kubectl get nodes showing the virtual node registered alongside the system node pool. A virtual node is a Kubernetes node You target it the same way you would target any node. These few lines in a manifest say "run this on the virtual node": nodeSelector: virtualization: virtualnode2 kubernetes.io/os: linux tolerations: - key: virtual-kubelet.io/provider operator: Exists effect: NoSchedule That is the entire integration surface. No new API to learn, no separate deployment pipeline, no application changes. kubectl describe, kubectl logs, and kubectl exec, the standard commands for inspecting and troubleshooting, all work as they would anywhere else, including opening a shell inside a container running in a Hyper-V isolated boundary. Image 2: kubectl get / kubectl logs / kubectl exec against a virtual-node-hosted pod. Scaling stays trivial. kubectl scale deployment demo-deployment --replicas=10 lands every replica on the same virtual node, with no VMSS scale event, no provisioning latency, no climbing node-count chart. The same flow scales just as cleanly to hundreds. Cost follows the same shape. Each pod is billed per second against the cores and memory it requests, at ACI rates, and billing stops when the pod stops. Image 3: kubectl get pods -o wide after scaling, every replica on the virtual node, no additional VMs. Logs and metrics flow through the same path you already use, so existing dashboards and alerts keep working. One annotation makes a pod confidential Turning a regular container into a confidential one takes a single addition to its manifest: a policy that pins exactly which images, commands, environment variables, mounts, and capabilities are permitted inside the Trusted Execution Environment. The format is a base64 encoded Rego document, called a CCE (Container Confidential Enforcement) policy. You do not write that policy by hand. A tool generates it from the manifest you already have: az extension add -n confcom az confcom acipolicygen --virtual-node-yaml ./hello-world-deployment.yaml The tool pulls each image, hashes its layers, builds the allow-list, and injects the annotation back into the manifest. kubectl apply, and you're done. (acipolicygen has prerequisites of its own, including a working Docker installation; see the confcom documentation.) Image 4: az confcom acipolicygen pulling and hashing images, emitting the base64 policy. Here is why this is a genuinely new isolation primitive rather than a stronger version of an existing one. Most container security policy is enforced by software in the cluster, which means an attacker who compromises the host can potentially bypass it. This policy is enforced by the guest operating system inside the TEE instead. The underlying hardware, AMD SEV-SNP, also produces an attestation report, retrievable from inside the container, which is a cryptographic proof that the workload running is the workload you specified and nothing tampered with it. That is the guarantee regulated industries have been asking for, and increasingly the one AI workloads running untrusted code need too. The same per pod boundary is also what makes multi-tenancy on a single cluster realistic, though multi-tenancy in production still depends on your network and identity boundaries, which sit outside what the isolation layer itself provides. Background: Microsoft Learn: confidential containers on ACI . Wrapping up Virtual nodes on ACI give containers on Azure two things that were previously hard to deliver cleanly on Kubernetes: Effortless burst capacity on Azure's serverless container platform, billed per second for the cores and memory used, with no capacity planning and no waiting for machines. Confidential containers with hardware attested, per container isolation inside a Trusted Execution Environment. Virtual nodes are additive, not a replacement. Traditional node pools remain the right home for steady state, DaemonSet, and persistent volume workloads, and AKS features such as Node Auto Provisioning and Virtual Machine Node Pools already make that baseline more flexible. Virtual nodes on ACI absorb the spikes, the short-lived jobs, and the specialized isolation work on top. Where to start New to containers on Azure? Start with a small AKS cluster and add a virtual node from day one. You get a managed Kubernetes environment without having to guess your peak capacity in advance, and the elastic layer is there the first time you need it. Already running AKS? Add a virtual node to an existing cluster and move one bursty or short lived workload to it. Nothing else changes, and the comparison is immediate. Evaluating platforms? The capability that is hard to find elsewhere is the confidential containers path: hardware attested isolation per container, reachable through a standard Kubernetes manifest. The result: virtual nodes on ACI expand what AKS can run, with more capacity and stronger isolation, without changing the Kubernetes operating model you already use. Same kubectl, same manifests, same GitOps. New ceiling. For the high-level overview, official documentation, and Helm details, the Microsoft Learn is the source of truth. The companion repo holds the demo manifests used in this post. Acknowledgements I'd like to thank Gurpreet Virdi , Partner Group Engineering Manager, whose guidance shaped this post from the first outline through to publication. Her product leadership ensured this post reflects both the technical depth and the customer value of virtual nodes on ACI. Thanks to Gabriel Fuhrman , Senior Software Engineer, for his detailed technical review. His feedback refined the technical content and significantly improved the accuracy and depth of this post. Christopher Little , Principal CSA, shaped the enterprise adoption perspective, and Adam Sharif , CSA, reviewed the post from the earliest draft. Thanks also to Kirthi Maguluri , Senior Product Manager, and Varun Shandilya , Principal Product Manager, for their review of the blog.

Prepare your tenant estate for AI: Join our upcoming webinars

Mon, 21 Sep 2026 16:04:27 +0000

Securing multiple tenants has never been more critical. From mergers and acquisitions to shadow IT and test environments, multi-tenant complexity can introduce gaps in security, compliance, and governance. Now that Microsoft Entra Tenant Governance is generally available, you can gain visibility across every tenant, implement consistent policies, and confidently reduce shadow-tenant risk. A strong identity foundation prepares you for the age of AI. To help you get started, we’re hosting exclusive webinars that explore multi-tenant risk and show you how to deploy Microsoft Entra Tenant Governance to maintain a secure, compliant tenant estate. These sessions are designed for security and identity leaders who need a strategy for securing multi-tenant environments and for IT and identity professionals who need to govern sprawling tenant environments efficiently and securely. Don’t miss this opportunity to learn how to strengthen your identity foundation. Register now for the webinars: 1. Secure multitenant environments with Microsoft Entra Tenant Governance In this session, we’ll explore why fragmented environments create vulnerabilities and what you can do to close security gaps. Learn how to detect shadow IT tenants, establish governance relationships, and scale configuration management effectively. 📅 Date: Tuesday, September 15, 2026 ⏰ Time: 9:00 AM–10:00 AM Pacific Time Watch it on demand: https://aka.ms/EntraTG-AMA 2. Microsoft Entra Tenant Governance in action: Best practices and real-world scenarios In this session, we’ll explore practical scenarios for protecting your multitenant environments while maintaining productivity. Bring your questions about deployment, workflows, and real-world scenarios for our product experts. 📅 Date: Tuesday, October 6, 2026 ⏰ Time: 9:00 AM–10:00 AM Pacific Time Register here: https://aka.ms/EntraTG-webinar -Hien Nguyen Additional resources Microsoft Entra tenant governance documentation Microsoft Entra tenant estate architecture guidance Microsoft Entra Tenant Governance deployment guide Microsoft Entra Tenant Governance licensing guide Learn more about Microsoft Entra Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds. ⁠ Microsoft Entra News and Insights | Microsoft Security Blog Microsoft Entra blog | Tech Community Microsoft Entra documentation | Microsoft Learn Microsoft Entra discussions | Microsoft Community

What the Azure API Management integration means for Azure Service Bus

Mon, 21 Sep 2026 16:00:00 +0000

Azure API Management now provides a generally available policy for sending messages to Azure Service Bus. Using the send-service-bus-message policy , an API request can send a message directly to a Service Bus queue or topic. This allows you to put a governed HTTP API in front of an asynchronous messaging solution, without adding an intermediary service just to translate and forward the request. The API Management announcement explains how to configure the policy. In this post, we look at the Service Bus patterns you can use behind that API. Add an asynchronous boundary to your API An API often needs to accept a request without making the caller wait for all the work behind it to finish. For example, submitting an order might start inventory checks, payment processing, fulfillment, and customer notifications. A file upload might start validation and several other workflows. API Management handles the synchronous API boundary. It can authenticate and authorize callers, validate or transform requests, and apply quotas and rate limits. The policy then sends the message to a pre-created Service Bus queue or topic, where consumers can process it independently. This means the API can return an acceptance response while Service Bus holds the work for downstream processing. Producers and consumers can run at different rates, and a temporary issue in a consumer does not have to become an API failure. API Management authenticates to Service Bus using a system-assigned or user-assigned managed identity with the Azure Service Bus Data Sender role. Applications calling the API only need access to the API, not to the Service Bus namespace. Queue-backed APIs for commands and work items A queue fits when an API request represents a command or work item that one consumer should complete. Examples include process this order , generate this document , or import this file . The producer and consumer do not have to be available at the same time. Once Service Bus accepts the message, the consumer can process it independently of the original API request. This is useful for long-running work and integrations where the downstream system has limited availability. A queue also provides load leveling. It absorbs bursts of requests while consumers process messages at a sustainable rate. Multiple competing consumers can share the work, and you can scale those consumers without changing the public API. For workflows where the caller needs the final result, the API can expose a status endpoint or the application can send a notification when processing completes. Send commands to the right processor A queue fits when every command follows the same processing path. Use a topic when the same API sends work to different processors. For example, a document API can add the document type, tenant, region, or priority to the message properties. Subscription filters then direct each message to the right processor while callers continue to use one HTTP API. Each subscription has its own consumers and message state, so every processing path can scale independently. You can add or change the routing without changing the public API. Carry messaging information across the API boundary The policy can set the message body, application properties, message ID, session ID, and time-to-live. This allows the API to include information that Service Bus and downstream consumers can use: Add properties such as command type, tenant, region, or schema version for routing and filtering. Set a valid GUID as the message ID, such as the API Management request ID, when using Service Bus duplicate detection. Consumers should still process messages idempotently, as retries can happen elsewhere in the workflow. Set a valid GUID as the session ID to process related messages in order. The queue or topic subscription must have sessions enabled, and the consumer must accept the session. Set a time-to-live when work is no longer useful after a specific period. API Management can also store the result of the send in a policy variable. A send failure normally enters API Management error handling, or you can configure the policy to continue and handle the result in the API flow. Where this pattern fits This integration is useful when callers use HTTP while the system behind the API uses asynchronous messaging. Partners, web applications, mobile applications, and webhook producers can call a governed API without needing an AMQP library or access to Service Bus. Behind the API, you can use queues and topics for buffering, independent scaling, competing consumers, and command routing. The policy covers the send side of the integration. Consumers use the Service Bus SDKs or supported protocol integrations to receive and process the messages. More information can be found in the API Management policy reference , the configuration guide , and the Service Bus queues, topics, and subscriptions documentation .

Bringing Defender Experts protection and proactive hunting into focus

Mon, 21 Sep 2026 16:00:00 +0000

As threats move faster and security environments grow more complex, security teams need to quickly understand what matters, where potential risks may exist, and when action is needed. The value of Defender Experts MDR, which includes Defender Experts Hunting, extends beyond the incidents customers see. Across managed detection and response and managed threat hunting, Microsoft experts proactively investigate suspicious activity and emerging threats, helping provide earlier awareness of potential risk and greater confidence when investigations find no hidden activity. Now, new Defender Experts experiences in the Defender portal bring that ongoing work into focus. Customers can more easily discover Defender Experts MDR and Defender Experts Hunting, understand what experts are investigating and what they found, identify what requires attention, and know when action is needed. We’re introducing a more cohesive Defender Experts experience, including a dedicated homepage entry point, persistent left-navigation access, consolidated overview experiences, and a new Hunts experience with visibility into in-progress and completed hunts. Together, these experiences create a clearer, purpose-built home for customers to see expert activity, understand outcomes, and move from insight to action. Discover Defender Experts in your existing security workflows Defender Experts is now easier to discover and access within the Microsoft Defender portal. A dedicated card on the homepage provides visibility into the service as customers begin their security workflow, while a persistent Defender Experts section in the left navigation provides a consistent way to access the experience from across the portal. These entry points help make Defender Experts a more connected part of customers’ existing security operations workflows. Teams can move from a broader view of their security environment into the expert activity, investigations, findings, and actions relevant to them without losing context. Together, the homepage and navigation establish a consistent starting point for Defender Experts, making it easier for customers to discover the service, return to expert-led work, and move into the details that require their attention. Figure 1. Dedicated Defender Experts entry points on the Microsoft Defender portal homepage and left navigation. Understand what matters and where attention is needed most The Defender Experts overview page brings service activity, outcomes, and next steps together in one connected view, helping customers quickly understand what Defender Experts is doing on their behalf and where their attention may be required. For Defender Experts MDR customers, the overview brings together managed responses and messages, operational service status, reports, and recent hunting outcomes. Customers can identify where attention may be needed and move directly to the supporting details. Defender Experts for Hunting customers receive an overview built on the same foundation and tailored to proactive managed hunting, providing visibility into expert-led investigations and hunting outcomes. This visibility is valuable even during periods with low incident volume. The absence of incidents does not mean an absence of expert activity. Customers can see the continuity of proactive hunting work and better understand how Defender Experts continues to investigate potential threats on their behalf, ensuring protection against threats. Figure 2. Consolidated overview experiences for Defender Experts MDR and Defender Experts for Hunting. See proactive protection in action with the Hunts experience We’re also introducing a new Hunts experience that gives Defender Experts customers a centralized view of the hunts Microsoft experts are conducting in their environment. Customers can see investigations while they are in progress and return after a hunt is complete to review the outcome and supporting details. This creates a more continuous view of proactive hunting, from the questions experts are investigating to the conclusions they reach. When a noteworthy threat is circulating, customers can see that Defender Experts is investigating it on their behalf. The status-aware experience distinguishes work in progress from final conclusions, helping customers understand whether experts are still investigating, what they ultimately found, and whether follow-up action is required. The Hunts experience includes both intelligence-based and suspicious activity hunts. Intelligence-based hunts proactively investigate emerging threats, attacker techniques, campaigns, and other intelligence-driven hypotheses. Suspicious activity hunts begin when Defender Experts identifies behavior in a customer environment that warrants deeper investigation. Importantly, a hunt does not need to uncover a threat to provide value. Completed hunts create a durable record of proactive hunting activity, including investigations that do not result in an incident, giving customers greater visibility into the work performed on their behalf. Figure 3. The Hunts experience provides a centralized view of active and completed hunts. From expert activity to action Together, these experiences create a more connected Defender Experts journey. The homepage and persistent navigation make Defender Experts easier to discover. The overview helps customers understand service activity, outcomes, and where attention may be needed. And the Hunts experience provides greater transparency into proactive investigations, from work underway to completed findings. For Defender Experts MDR customers, these experiences bring managed detection and response and proactive hunting into a more cohesive portal experience. For Defender Experts for Hunting customers, they give proactive hunting a dedicated experience that reflects how the service delivers ongoing value. Most importantly, the new experiences help security teams answer practical questions more quickly: What are Microsoft experts investigating? What did they find? What matters to my organization? And does my team need to act? As more Defender Experts capabilities and security insights come into the Microsoft Defender portal, this experience provides a foundation for customers to discover them, understand how they relate to their service, and move from insight to action. Get started Eligible Defender Experts customers can access these experiences in the Microsoft Defender portal, subject to their service entitlement and portal permissions. To learn more about Defender Experts MDR, visit the webpage and product documentation . You can also join the Microsoft Defender Experts community on Microsoft Tech Community to ask questions, participate in discussions, and share feedback.

Intune App Inventory From Four Hours to About Five Minutes

Mon, 21 Sep 2026 15:18:51 +0000

This blog will show how the Device App Inventory Agent now reacts to application changes instead of waiting for the normal collection 4-hour harvest cycle Introduction to App Inventory App […]

Demystifying Dynamic AI Routing: Exploring the model router in Foundry Models with RouteLab

Mon, 21 Sep 2026 15:00:00 +0000

As enterprise generative AI applications mature, engineering teams face a continuous balancing act between cost, latency, and response quality. Hard-coding a frontier model for every request ensures high quality but maximizes token costs and latency. Conversely, defaulting to smaller, faster models risks degradation in accuracy for complex reasoning tasks. To solve this architectural challenge, developers can use the model router in Foundry Models —an intelligent, real-time routing engine. By combining this capability with testing environments like RouteLab , developers can eliminate the guesswork of model selection, visually evaluate routing decisions on custom datasets, and build highly optimized AI systems. What is the model router in Foundry Models? The model router is a purpose-built machine-learning model that sits between your application and a configured pool of large language models (LLMs). Rather than relying on rigid, hard-coded rules, the router analyzes the complexity, required reasoning capabilities, and context of each incoming prompt in real time to select the most suitable LLM. By targeting a single deployment, developers gain access to three distinct routing modes: Balanced (Default): Evaluates all models within a narrow quality margin and selects the most cost-effective option for general-purpose scenarios. Cost: Broadens the acceptable quality band to aggressively minimize token costs—ideal for high-volume, budget-sensitive workloads. Quality: Always routes to the highest-performing model for that specific prompt, ignoring cost implications for complex reasoning tasks. Getting Started: Running RouteLab Locally Before diving into the visual evaluations, you need to spin up RouteLab in your local environment. The model-router-playground repository is designed for a frictionless developer experience right out of the box. Part 1: Setting Up the Environment Clone the Repository and Open in VS Code: Start by cloning the repository to your local machine. Open the cloned folder directly inside Visual Studio Code (VS Code) so that all project assets, scripts, and dependencies are loaded in your editor workspace. Launch the Script: Open the integrated terminal in VS Code and execute the setup script by running ./start.ps1 . This kicks off the environment initialization, installs required dependencies, and prepares the backend routing services. Part 2: Interactive Authentication and Launch Complete the 6-Step Azure Login and Launch the UI: Once the script executes, it presents a guided, 6-step interactive authentication workflow directly in your terminal. This wizard safely connects your local setup with your Azure credentials, respects enterprise access boundaries, and wires up your designated Microsoft Foundry Model Router resource. Upon completing step 6, RouteLab automatically opens in your default browser, presenting the full testing harness. Hands-On with RouteLab: The Developer Playground Understanding how dynamic routing behaves in practice is critical before deploying it to production. The model-router-playground repository provides a practical, UI-driven approach to exploring this architecture through its RouteLab interface. As seen in the RouteLab dashboard below, the environment is designed to demystify the routing process without requiring custom evaluation scripts. Here is how it empowers development teams: 1. Interactive Manual Evaluation- " Supports Bring your own Dataset " One of the biggest questions developers have about dynamic routing is, "Which model will it pick for my specific prompt?" RouteLab’s central Manual Evaluation interface allows you to select your desired mode ( Balanced, Cost, or Quality ) and test the router. Crucially, this is where the "Bring Your Own Data" USP truly shines. Instead of relying solely on generic examples or typing prompts one by one, you can seamlessly import your custom dataset (CSV or JSONL) directly into the Manual UI. By running your proprietary, domain-specific questions through the interface, you gain instant, line-by-line transparency into how the router handles your exact enterprise workloads—immediately displaying the selected underlying model, token usage, and latency for your own data. To get a comprehensive view of the router's decision-making process, you can execute your imported dataset three separate times —once for each routing mode . After completing these runs, simply navigate to the Analytics tab and launch the Compare button. This powerful feature allows you to evaluate all three executions side-by-side, providing a clear, empirical comparison of cost savings, latency overhead, and model selections across the Balanced, Cost, and Quality modes for your specific prompts. 2. Quick Testing with the Routing Range To rapidly build intuition on how the router behaves, the UI features a "Test the routing range" capability. With a single click—such as the "Run 15 (quick)" or "Run 30 (full)" buttons—developers can fire off a spectrum of predefined prompts from direct instructions to complex synthesis. This allows you to watch the router actively adapt its model selection across a diverse ladder of complexities. 3. Auto Evaluation at Scale: Validating Custom Workloads While manual testing builds intuition line-by-line, production readiness requires scale. RouteLab’s Auto Evaluation engine allows developers to run bulk assessments. It comes pre-loaded with bundled datasets (like mixed-prompts.jsonl or java_custom.jsonl) for quick benchmarking, but its ultimate USP is executing automated evaluations on your imported custom datasets. To make formatting effortless, you can download a sample .jsonl file from the available bundled datasets directly within the UI, providing a perfect template to construct your own custom datasets. By uploading your populated proprietary files, teams can automate the execution of hundreds of their own prompts. This ensures your routing strategy and cost projections are validated against the real-world datasets your application will handle in production, bridging the gap between generic benchmarks and enterprise reality. Under the Hood: The Code Behind Auto Evaluation Beyond the UI experience, the complete underlying code for this Auto Evaluation engine is available in its own dedicated repository: microsoft-foundry/Model-Router-Auto-Evaluation . By exploring this repository, developers can see exactly how the batch-processing, routing logic, and metric aggregations are programmatically implemented. This open-code approach makes it incredibly easy for engineering teams to lift and shift the evaluation framework directly into their own enterprise CI/CD pipelines or custom testing harnesses. After successful completion of Auto Evaluation, you click the open button Click on the open button under Past Evaluation to get the dashboard. 4. Deep Dives with Analytics and Logs Data drives deployment decisions. The top navigation of the RouteLab UI seamlessly transitions users from Evaluation into Analytics and Logs . Instead of parsing raw JSON telemetry, developers can visualize the aggregate results of their custom and bundled datasets: Cost Distribution: See the exact token savings achieved by routing simpler tasks to smaller models. Latency Overhead: Measure the actual response times to validate that the router's overhead is negligible. Model Utilization: View visual breakdowns of how often frontier models are invoked versus specialized models under different routing modes. The Future is Dynamic The era of static, one-size-fits-all LLM deployments are ending. By leveraging the model router and visually validating your strategy through RouteLab—using both bundled and custom datasets—your team can confidently deploy AI architectures that are highly responsive, scalable, and remarkably cost-efficient. Ready to explore intelligent routing? Check out the model-router-playground on GitHub today and start optimizing your enterprise AI workloads! References & Resources Microsoft Learn Documentation: Model router in Foundry Models | Learn RouteLab Developer Playground: model-router-playground on GitHub Auto Evaluation Source Code: Model-Router-Auto-Evaluation on GitHub

Elasticsearch Vector Database on Azure: semantic search and RAG without managing a cluster

Mon, 21 Sep 2026 13:34:07 +0000

With Elasticsearch Vector Database , Elastic's new serverless offering for vector workloads, Azure customers can build semantic search, retrieval-augmented generation (RAG), and agent-powered experiences. Azure Native Integrations make it easy to discover, deploy, and manage the resource through the Azure portal. Built for AI, without managing a search cluster Elasticsearch Vector Database brings key retrieval capabilities together, so you can focus on your application: Hybrid search and relevance: Combine keyword and vector retrieval, with metadata filters and reranking to refine the context returned to your application. Managed embeddings and inference: Use Elastic's semantic_text field and managed inference to generate embeddings without running separate machine learning infrastructure. Context for agents: Give agents access to relevant Elasticsearch data and tools through integrations such as Elastic MCP Server in Microsoft Foundry . Built on Elastic's Search AI Lake architecture with Azure Blob Storage, Elastic Cloud Serverless manages the underlying infrastructure, so you don't have to provision or maintain clusters. Discover and deploy directly from Azure From the resource hub: Open Elastic Cloud (Elasticsearch) in the Azure portal. Select Create , then Elasticsearch Vector Database . From Azure Marketplace: Open Elasticsearch - Vector Database to review the offering and begin creating your resource. Discover Elasticsearch Vector Database alongside Elastic's search, observability, and security offerings. You'll need deployment permissions, such as Owner or Contributor access, on the target Azure subscription. Follow the creation flow to select your subscription, resource group, and an available region, then review the configuration and create your resource. Go from your resource to your first query Your resource overview in the Azure portal brings together connection links and shortcuts to Elastic's tools: Add data & embed: Add documents and generate embeddings using semantic_text and Jina models. Open Agent Builder: Ask natural-language questions grounded in your data. Open in Dev Tools: Start with a prefilled semantic search example, then adapt it to your index and queries. Start in Azure, then move directly into Elastic's tools to ingest, embed, and query your data. Try Elastic's vector and full-text search quickstart , then use the retrieved context in an application powered by Azure OpenAI. Keep management and billing connected to Azure The Azure native integration connects more than the creation experience: Familiar management: Organize Elastic resources with Azure resource groups and tags, and view them alongside your other Azure resources. Connected access: Use Microsoft Entra ID single sign-on to access Elastic from Azure. Manage the Azure resource in the portal, then use Elastic's tools for data and search workflows. Consolidated billing: Marketplace purchases appear on your Azure billing statement. View Elastic usage and costs in the Elastic Cloud Console. Eligible purchases also count toward your Microsoft Azure Consumption Commitment (MACC), subject to offer eligibility and agreement terms . Start building, and explore more on Azure Start your next AI project with Elasticsearch - Vector Database in Azure Marketplace, or open the Elastic resource hub in the Azure portal. New users get a 7-day free trial! Explore other Elastic offerings on Azure: Elasticsearch , Elastic Observability , and Elastic Security . Learn more about Elastic on Azure and how Azure Native Integrations connect partner services with Azure onboarding, management, identity, and billing.

Succeeding with AI

Mon, 21 Sep 2026 11:03:05 +0000

What I've learnt over a lot of customer and Microsoft's own AI ambition. ▬▬▬▬▬▬ C H A P T E R S ⏰ ▬▬▬▬▬▬ 00:00 - Introduction 00:23 - AI adoption 01:32 - Where can AI drive benefit 08:49 - What makes a good AI initiative 17:47 - Human and AI 18:44 - Where do we get stuck 22:21 - Rethinking our organization 23:11 - Intelligence and trust 23:39 - Intelligence 28:19 - Trust 35:52 - Models 38:44 - Amplifying the human 39:07 - Bad actors using AI 40:00 - Summary 41:01 - Close ▬▬▬▬▬▬ K E Y L I N K S 🔗 ▬▬▬▬▬▬ ► Whiteboard: 🔗 https://github.com/johnthebrit/RandomStuff/raw/master/Whiteboards/AISuccess.png ▬▬▬▬▬▬ Want to learn more? 🚀 ▬▬▬▬▬▬ 📖 Recommended Learning Path for Azure 🔗 https://learn.onboardtoazure.com 🥇 Certification Content Repository 🔗 https://github.com/johnthebrit/CertificationMaterials 📅 Weekly Azure Update 🔗 https://youtube.com/playlist?list=PLlVtbbG169nEv7jSfOVmQGRp9wAoAM0Ks ☁ Azure Master Class 🔗 https://youtube.com/playlist?list=PLlVtbbG169nGccbp8VSpAozu3w9xSQJoY ⚙ DevOps Master Class 🔗 https://youtube.com/playlist?list=PLlVtbbG169nFr8RzQ4GIxUEznpNR53ERq 💻 PowerShell Master Class 🔗 https://youtube.com/playlist?list=PLlVtbbG169nFq_hR7FcMYg32xsSAObuq8 🎓 Certification Cram Videos 🔗 https://youtube.com/playlist?list=PLlVtbbG169nHz2qfLvPsAz9CnnXofhmcA 🧠 Mentoring Content 🔗 https://youtube.com/playlist?list=PLlVtbbG169nGHxNkSWB0PjzZHwZ0BkXZZ ❔ Questions? Maybe I answered it in my FAQ 🔗 https://savilltech.com/faq 👕 Cure Childhood Cancer Charity T-Shirt Channel Store 🔗 https://johns-t-shirts-store.creator-spring.com/ 👂 Enable the subtitles and from there you can translate to your native language via the auto-translate feature in settings! https://youtu.be/v5b53-PgEmI for a demo of using this feature. SUBSCRIBE ✅ https://www.youtube.com/channel/UCpIn7ox7j7bH_OFj7tYouOQ?sub_confirmation=1 #ai #johnsavillstechnicaltraining #onboardtoazure

Building a Fully Local Maintenance Assistant with Microsoft Foundry Local

Mon, 21 Sep 2026 10:05:48 +0000

Building the Local RAG System The system was designed as a fully local RAG pipeline, with both retrieval and model inference running on the same machine. The knowledge base came from two equipment manuals covering pump and motor operation, maintenance, and troubleshooting. Rather than treating every page as plain text, I kept different types of information in forms that matched their structure, including paragraphs, Q&A entries, tables, procedures, and fault–cause–remedy troubleshooting records. The final corpus contained 165 retrievable records. Each record was embedded locally with all-MiniLM-L6-v2 and stored in ChromaDB. At query time, the system retrieved the most relevant manual records and passed the selected evidence to Phi-4-mini, a small language model (SLM) running through Microsoft Foundry Local, for grounded response generation. Once the required models and resources were installed, the full retrieval and inference workflow could run on the local machine without depending on cloud inference. I began with a simple Single-Agent RAG baseline. For each query, the system retrieved relevant manual evidence and used a single Phi-4-mini call to generate a grounded response. That gave me a clear reference point before I started adding separate model-driven stages for query understanding, retrieval, and reasoning. The Experiment That Changed the Architecture The next version split the workflow into three roles: Query Understanding, Retrieval, and Reasoning. All three reused the same local Phi-4-mini model through Microsoft Foundry Local, but with different prompts and responsibilities. I expected this separation to give the system more control over how queries were interpreted and how evidence moved through the pipeline. In practice, the extra stages added a noticeable cost, so I profiled the pipeline to see where the time was going. The stage timings showed where the delay was coming from: Query Understanding: 15.469 s Evidence Selection: 11.557 s Reasoning: 8.251 s Vector search: 0.002 s Vector search was only a tiny part of the total time. Most of the latency came from the stages that repeatedly called the local model. The bottleneck was repeated model inference, not vector search. I therefore started looking for decisions that could be handled reliably without another SLM call. The end-to-end numbers matched the profile. The Single-Agent baseline averaged 23.1 seconds per query, compared with 33.0 seconds for the Initial Multi-Agent system, without a consistent improvement in answer quality. That shifted the focus of the project from making the pipeline more agentic to deciding where model reasoning was actually useful, and where simpler deterministic control would be enough. A Deterministic-First Hybrid Design The Hybrid redesign kept the same local retrieval stack and Phi-4-mini setup, but changed when the model was asked to make decisions. Clear, bounded routing decisions were handled deterministically first. Depending on the query, the system could proceed to retrieval, request clarification when required information was missing, or stop requests that depended on information outside the manuals. Phi-4-mini was used for query analysis only when these rules could not make a reliable decision. In the 12-case final evaluation, Phi-4-mini was needed for query analysis in only three cases. The remaining routing decisions were handled deterministically. The Hybrid pipeline also handled clearly multi-part requests differently. Instead of relying on a single retrieval query, the system could identify separate information needs and search them alongside the original request. For example, a two-part pump question could be handled like this: Multi-part Query │ ▼ "What should I check before starting the B114N pump, and what should I inspect if it fails to prime?" │ ▼ Deterministic Decomposition │ ┌──────────────────┼──────────────────┐ ▼ ▼ ▼ Original Query Pre-start Checks Failure-to-prime Search Search Search │ │ │ └──────────────────┼──────────────────┘ ▼ Combine Ranked Results │ ▼ Retain Component Provenance │ ▼ Candidate Evidence The decomposition was deliberately conservative. It handled clear structures such as multiple questions, comparisons, or lists of requested facts, and did not split a query simply because it contained a comma or the word “and.” Once candidate evidence had been retrieved, clear matches could be selected without another model call, while Phi-4-mini was used when the candidates required additional judgement. Candidate Evidence │ ▼ Can deterministic rules select the evidence? / \ Yes No │ │ ▼ ▼ Deterministic Selection Phi-4-mini Evidence Selection │ │ └───────┬────────┘ ▼ Selected Evidence │ ▼ Evidence Guard │ ┌────────────────┼────────────────┐ ▼ ▼ ▼ Sufficient More evidence Insufficient coverage already in the evidence │ candidate pool │ ▼ │ ▼ Response ▼ Stop Generation Retain additional evidence │ ▼ Re-check coverage │ └──────► Evidence Guard The Evidence Guard checked whether the selected records covered the information requested by the user. Supporting evidence already present in the retrieved candidate set could be added before checking coverage again. When the available evidence was still insufficient, the pipeline stopped instead of asking the model to fill the gap. The guard never triggered a new retrieval or SLM call. The final response stage used the model selectively as well. Some bounded cases, including clarification, out-of-scope requests, insufficient evidence, and selected structured answers, could be handled without another model call. When synthesis was still needed, Phi-4-mini generated a grounded response from the selected evidence, while citation formatting remained deterministic. What Changed? I evaluated the three architectures on the same frozen 12-case test set, using answer quality and end-to-end latency as the main comparison points. The Final Hybrid system produced the lowest average latency while maintaining answer quality at roughly the same level as the Single-Agent baseline. Architecture Quality score Mean latency Single-Agent RAG 7.00 / 10 22.709 s Initial Multi-Agent 6.50 / 10 33.454 s Final Hybrid 7.08 / 10 16.905 s The Initial Multi-Agent design was the slowest of the three and did not produce a consistent quality improvement over the simpler baseline. The Hybrid redesign reversed that trend: average latency fell to 16.9 seconds while the overall quality score remained comparable to the baseline. For this prototype, adding more model-driven stages was therefore less useful than being selective about where model reasoning was actually needed. The call counts show the same change. Across the 12 final cases, the Hybrid system made 12 stage-level SLM calls: three during query analysis, four during evidence selection, and five during reasoning. A pipeline that invoked the SLM at all three stages for every query would require 36 stage-level calls over the same 12 cases. This was only a small 12-case evaluation, so I would not treat it as a final measure of system performance. What it did show was that cutting unnecessary SLM calls made the local pipeline faster without hurting the quality score in this test. From Pipeline to Local Application I connected the Final Hybrid backend to a lightweight PySide6 desktop interface. The application lets a user enter a maintenance question, view the generated answer, and inspect the supporting manual sources. What I Learned The biggest lesson from the project was that adding more model-driven stages did not automatically make the system better. The Initial Multi-Agent design gave each stage a clearer role, but the extra SLM calls increased latency without consistently improving answer quality. I also found that good retrieval alone was not enough. The system still needed to decide whether the retrieved evidence actually covered the user’s request and whether another model call was necessary. This is where deterministic routing, evidence checks, and model reasoning worked well together. By the end of the project, the question was no longer how many agents to add, but where an SLM call was actually useful. In this system, the best result came from combining simple deterministic control with model reasoning only where it was needed. What Comes Next The next step would be to test the system on a larger and more varied set of maintenance questions, including more unseen cases and feedback from engineers. I would also like to compare different local models and hardware configurations to see how response quality, latency, and resource use change in practice. Beyond that, the same approach could be applied to a larger maintenance knowledge base or adapted to other equipment domains. One question I would like to explore further is whether the deterministic-first design still works as well when the corpus, query types, and deployment conditions become more varied. Resources Foundry Local documentation Get started with Foundry Local Foundry Local architecture overview

GitHub Actions OIDC: Moving to Immutable Subject Claims

Mon, 21 Sep 2026 10:00:00 +0000

GitHub Actions can authenticate to Azure without storing a long-lived client secret in the repository. With OpenID Connect (OIDC), a workflow requests a short-lived token from GitHub and Microsoft Entra ID exchanges that token for an Azure access token. That is a much better authentication model than keeping a service principal secret in GitHub. However, the trust relationship still needs to be designed carefully. Microsoft Entra federated identity credentials match claims in the GitHub token, especially the sub (subject) claim. If that subject is built only from repository and owner names, it can change or be recycled. GitHub now supports an immutable subject format that includes the stable owner and repository IDs. This post explains why that matters and how to migrate an Azure federated identity credential without taking an existing workflow offline. The problem with name-based subjects Historically, a GitHub Actions workflow running on the main branch of contoso/payments-api produced a subject similar to this: 1 repo:contoso/payments-api:ref:refs/heads/main The value is readable, but both names are mutable. An organisation or repository can be renamed, transferred, deleted, and potentially recreated. If a federated identity credential remains configured for the old value, a different repository could eventually produce the same subject. This is known as subject recycling . The credential is still present, but the workload it originally trusted is no longer the workload producing the matching token. A stale credential that trusts a workload that no longer exists is also called a dangling federated identity credential . The risk is not unique to GitHub. The general rule for workload federation is simple: when an issuer provides a stable identifier, anchor trust to that identifier rather than to a display name or path. What is an immutable GitHub subject? The immutable format keeps the names for readability and adds the permanent owner and repository IDs: 1 repo:@/@:ref:refs/heads/main For example: 1 repo:contoso@5544123/payments-api@821093847:ref:refs/heads/main The owner and repository IDs are assigned by GitHub and are not reused. Renaming or transferring the repository therefore does not make the original subject belong to a different repository. The @ separator is intentional: GitHub usernames and repository names cannot contain it. For example, the example repository used with this post is builtwithcaffeine/bwc-github-federation-example . The repository includes the branch- and environment-based GitHub Actions workflows discussed in this post, so you can inspect the configuration and try the pattern yourself. Its immutable branch subject is: 1 repo:builtwithcaffeine@141853123/bwc-github-federation-example@141853123:ref:refs/heads/main The IDs in these examples are illustrative. Always retrieve the current values from GitHub before creating a credential. For example, the GitHub CLI can return the owner and repository IDs together: PowerShell Bash Copy 1 2 3 $owner = "builtwithcaffeine" $repository = "bwc-github-federation-example" gh api repos / $owner / $repository - -jq '{owner_name: .owner.login, owner_id: .owner.id, repo_name: .name, repo_id: .id}' 1 2 3 owner = "builtwithcaffeine" repository = "bwc-github-federation-example" gh api "repos/ $owner / $repository " --jq '{owner_name: .owner.login, owner_id: .owner.id, repo_name: .name, repo_id: .id}' Important IMPORTANT: Immutable subjects apply to repositories on GitHub.com. They are not available on GitHub Enterprise Server. Existing repositories also keep the old format until they opt in, while repositories created after July 15, 2026 use the immutable format by default. The branch, tag, environment, or pull request context still appears after the repository segment. Only the identity of the owner and repository becomes immutable. How the Azure trust relationship works An Azure federated identity credential normally checks three important values: Issuer: https://token.actions.githubusercontent.com Subject: the GitHub OIDC sub claim Audience: api://AzureADTokenExchange The subject should also be scoped as narrowly as the deployment requires. For example, a production deployment from the main branch might trust this exact subject: 1 repo:contoso@5544123/payments-api@821093847:ref:refs/heads/main If the workflow deploys through a GitHub Environment instead, the subject includes the environment: 1 repo:contoso@5544123/payments-api@821093847:environment:production Do not use a broad subject just because it is easier to configure. A credential matching every branch or every repository gives a compromised workflow more opportunity to obtain an Azure token. Prerequisites Before starting the migration, check the following: The repository is hosted on GitHub.com. The workflow already uses OIDC or is ready to use it. The Microsoft Entra application or user-assigned managed identity has a federated identity credential. You have permission to update the GitHub OIDC settings and the Entra application. You know the GitHub owner ID and repository ID. The owner and repository IDs are available through GitHub’s OIDC settings and REST API. GitHub also provides a preview mechanism so that you can confirm the subject a workflow will emit before changing the Entra trust policy. The migration strategy The safest migration is additive rather than destructive: Get the immutable owner and repository IDs. Create a new Entra federated identity credential for the immutable subject. Enable immutable subjects for the repository or organisation in GitHub. Run the workflow and confirm that Azure authentication succeeds. Remove the old name-based credential. Creating the new credential before changing GitHub keeps the existing workflow working during the transition. Removing the old credential only after a successful run prevents the migration from becoming an unnecessary outage. Create the immutable federated credential Save a credential definition such as the following as credential.json . Replace the example values with the IDs and subject for your own repository. 1 2 3 4 5 6 { "name" : "payments-api-main-immutable" , "issuer" : "https://token.actions.githubusercontent.com" , "subject" : "repo:contoso@5544123/payments-api@821093847:ref:refs/heads/main" , "audiences" : [ "api://AzureADTokenExchange" ] } For an Entra application, create the credential with Azure CLI: 1 2 3 az ad app federated-credential create \ --id \ --parameters ./credential.json The --id value is the object ID of the application, not the application (client) ID. Keep that distinction in mind when scripting the migration. Create one credential for each subject the workflow can present. For example, a workflow using both a production environment and a staging environment needs a trust entry for each intended subject unless you deliberately use a flexible federated identity credential. The example repository uses the following environment subjects: 1 2 3 4 5 # environment: dev repo:builtwithcaffeine@141853123/bwc-github-federation-example@1380014691:environment:bwc-dev # environment: prod repo:builtwithcaffeine@141853123/bwc-github-federation-example@1380014691:environment:bwc-prod Those subjects allow the Entra application to distinguish between the development and production deployment environments. Create separate credentials when the environments should have different Azure permissions or different trust policies. Flexible federated identity credentials If a workflow needs to support multiple branches or tags, a flexible federated identity credential can match the immutable repository prefix while still checking the repository ID separately: 1 2 3 4 5 6 7 8 9 { "name" : "payments-api-repository-immutable" , "issuer" : "https://token.actions.githubusercontent.com" , "claimsMatchingExpression" : { "value" : "claims['sub'] matches 'repo:contoso@5544123/payments-api@821093847:*' and claims['repository_id'] eq '821093847' and claims['repository_owner_id'] eq '5544123'" , "languageVersion" : 1 }, "audiences" : [ "api://AzureADTokenExchange" ] } The additional repository_id and repository_owner_id checks make the trust boundary explicit. Use a flexible credential only when the broader matching behaviour is intentional, and keep the expression limited to the repository and owner that should receive access. Enable immutable subjects in GitHub Existing repositories can opt in from the repository or organisation Actions OIDC settings. GitHub also exposes API controls and a preview endpoint for checking the resulting subject format. Before enabling the setting, compare the preview value with the subject in credential.json . This catches common mistakes such as: Using the application client ID instead of the GitHub repository ID Omitting the owner ID Using a branch subject when the workflow actually references an environment Forgetting that a pull request has a different subject context After opt-in, newly issued OIDC tokens use the immutable subject. The workflow itself usually does not need a code change, but it must have permission to request an OIDC token. The following is the branch-based workflow from the example repository: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 name : "GitHub - Azure OIDC Example - Branch" on : push : branches : [ "main" ] workflow_dispatch : permissions : id-token : write contents : read jobs : oidc-auth : runs-on : ubuntu-latest steps : - uses : actions/checkout@v7 - uses : azure/login@v3 with : tenant-id : ${{ secrets.AZURE_TENANT_ID }} client-id : ${{ secrets.AZURE_CLIENT_ID }} subscription-id : ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name : Verify Azure login run : az account show The id-token: write permission allows the job to request the GitHub token; it does not grant write access to the repository or Azure resources. Azure permissions still come from the role assignments on the application or managed identity. The AZURE_TENANT_ID , AZURE_CLIENT_ID , and AZURE_SUBSCRIPTION_ID values identify the Azure tenant, application, and subscription. They are not client secrets. The OIDC token is what allows Microsoft Entra ID to authenticate the workflow without storing a long-lived credential in the repository. Environment-based workflow The second example selects an environment at dispatch time. The job’s environment value changes the GitHub OIDC subject, so the Entra application can use separate credentials for bwc-dev and bwc-prod : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 name : "GitHub - Azure OIDC Example - Environment" on : workflow_dispatch : inputs : environment : description : "Select deployment environment" required : true type : choice options : - bwc-dev - bwc-prod permissions : id-token : write contents : read jobs : oidc-auth : runs-on : ubuntu-latest environment : ${{ inputs.environment }} steps : - uses : actions/checkout@v7 - uses : azure/login@v3 with : tenant-id : ${{ secrets.AZURE_TENANT_ID }} client-id : ${{ secrets.AZURE_CLIENT_ID }} subscription-id : ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name : Verify Azure login run : az account show Because the job references the selected environment, GitHub emits an environment subject rather than a branch subject. Configure the bwc-dev and bwc-prod environments with the appropriate protection rules and secrets, then create matching federated credentials in Entra ID. Validate before deleting the old credential Run the workflow after enabling immutable subjects and verify both authentication and authorisation: The azure/login step completes successfully. The workflow can perform the expected Azure operation. The sign-in or audit logs show the intended application and tenant. The workflow is using the expected branch, tag, or environment subject. If the login fails, compare the token claims with the federated identity credential. GitHub’s actions-oidc-debugger action can help inspect the claims during troubleshooting. Do not leave a token containing sensitive claims in a public workflow log. Only after a successful run should you remove the old name-based credential: 1 2 3 az ad app federated-credential delete \ --id \ --federated-credential-id Removing the old entry matters. Leaving it behind preserves the original mutable trust relationship and means the migration has not fully addressed the subject-recycling risk. Operational recommendations Immutable subjects are a useful improvement, but they are not a replacement for a complete workload identity security model: Use least privilege. Give the Entra application only the Azure roles required by the deployment. Scope the subject. Prefer a specific environment or protected branch over every branch in a repository. Protect production environments. Use GitHub Environment approvals and branch restrictions where appropriate. Review credentials regularly. Remove federated credentials for retired repositories and workflows. Avoid long-lived secrets. Once OIDC is working, remove obsolete service principal secrets from GitHub. Treat reusable workflows carefully. If a reusable workflow is part of the trust boundary, consider matching its job_workflow_ref as well. Document the IDs. Keep the owner and repository IDs with the infrastructure code so a future migration does not depend on guesswork. Conclusion GitHub Actions OIDC removes the need to store long-lived Azure credentials, but the claims in the token still define the security boundary. A subject based only on names is readable but vulnerable to renames, transfers, deletion, and reuse. Immutable subjects solve that specific problem by combining the familiar repository name with GitHub’s stable owner and repository IDs. For an existing Azure integration, the practical path is to add the immutable credential, opt the repository in, validate a real workflow, and then remove the old mutable credential. That small migration closes a subtle trust gap and leaves the federation relationship tied to the workload you actually intended to trust. References Migrate GitHub Actions federated credentials to immutable subjects Mutable subjects in federated identity credentials GitHub OpenID Connect reference Immutable subject claims for GitHub Actions OIDC tokens Azure Login action

Spec-Driven Development comes to Azure Cosmos DB: The First Database Extension for GitHub Spec Kit

Mon, 21 Sep 2026 07:00:11 +0000

AI coding agents can write much of an application’s code, but developers still need to review the decisions behind it. For a Cosmos DB application, that includes choosing partition keys, modeling access patterns, and configuring the client. Those decisions affect cost, performance, and reliability long after the code compiles. We’ve written before about how Azure […] The post Spec-Driven Development comes to Azure Cosmos DB: The First Database Extension for GitHub Spec Kit appeared first on Azure Cosmos DB Blog .

Beyond Cherry-Picking: Evaluating Text-to-Image Models

Mon, 21 Sep 2026 07:00:00 +0000

In the rapidly evolving landscape of generative AI, large language model (LLM) evaluations have matured into standardized benchmark suites, Elo leaderboards, and automated judge pipelines. However, in the realm of Text-to-Image (T2I) synthesis , technical teams frequently slip back into what can only be described as "prompt roulette": tossing a few creative prompts into a playground, marveling at the most photorealistic image, and declaring a winner. In enterprise software engineering, this subjective, cherry-picked approach is a recipe for failure. Vendor marketing showcases represent the model's theoretical ceiling, but production viability is dictated by the model's performance floor across complex constraints, edge cases, and Responsible AI policies. The HEIM Image Comparison Lab (hosted on Azure Container Apps) provides an architectural blueprint for comparative model evaluation. In this post, we explore how to construct an end-to-end evaluation methodology across technical dimensions and operational scenarios. 1. The Core Trap: Why Aesthetics Can Deceive When assessing generative image backends, developers frequently fall into three traps: The Aesthetic Halo Effect : High dynamic range, dramatic lighting, and vibrant color grading often mask fundamental compositional errors and anatomical hallucinations. Failure of Instruction Following & Spatial Reasoning : Prompts requiring strict spatial arrangement (e.g., "a blue ceramic mug placed to the left of an open leather notebook with '2026 ROADMAP' printed on the cover" ) easily break diffusion networks that lack compositional comprehension. Overlooking Responsible AI (RAI) : Defaulting to severe demographic biases for generic occupational prompts, generating copyrighted watermark artifacts, or showing poor resilience against adversarial inputs. To build reliable multimodal applications, we must move from subjective visual inspection to multidimensional benchmarking. 2. The Evaluation Methodology: Unpacking the 12 HEIM Dimensions The Holistic Evaluation of Text-to-Image Models (HEIM) benchmark established by Stanford CRFM establishes a rigorous baseline. In a production-grade comparison lab, these can be mapped into four distinct capability clusters: A. Fidelity & Artistic Quality Image Quality : Pixel-level fidelity, absence of structural blur, correct anatomical geometry (hands, eyes, symmetry), and high-frequency textural resolution. Aesthetics : Principles of photography and digital art—rule of thirds, lighting contrast, tonal depth, and artistic coherence. Originality & Copyright Hygiene : Lack of synthetic watermark remnants, signature smudges, or verbatim memorization of copyrighted intellectual property. B. Comprehension & Reasoning Image-Text Alignment : Granular fidelity to entities, attributes (color, size, texture), and action modifiers specified in the prompt. Spatial & Physical Reasoning : Topological relations (left/right, foreground/background, stacked objects) and physical phenomena (shadow alignment, optical reflections, gravity). World Knowledge : Fidelity regarding real-world entities, historical attire, architectural landmarks, and botanical/biological taxonomy. C. Safety, Equity & Robustness Fairness & Bias : Demographic balance (gender, ethnicity, age) when prompts do not explicitly mandate specific identity profiles. Toxicity & Harm Prevention : Consistent adherence to content safety standards, suppressing NSFW, gore, or defamatory visual generation. Robustness : Stability of output semantic intent under prompt perturbations, typo injection, and syntax inversion. Multilinguality : Zero-shot semantic comprehension across non-English prompts (Chinese, Spanish, German, etc.) without losing cultural nuances. D. Production Efficiency Latency & Throughput : Time-to-Generate (TTG) across different resolutions (1024×1024 1024×1024 , 1536×1024 1536×1024 ), GPU compute memory footprint, and dollar-per-generation cost. 3. Connecting Dimensions to Real-World Workloads In the comparison lab environment, three enterprise-grade models are evaluated side-by-side under controlled parameters: MAI-Image-2.6 (Microsoft): High-precision typography rendering, commercial portraits, 3D asset generation, and cost-efficient scaling. gpt-image-2.5-flare (OpenAI): Multi-clause prompt adherence, complex compositional layout parsing, and rapid conversational ideation. FLUX.2-pro (Black Forest Labs / ElevenLabs): Ultra-high-resolution detail, photorealistic rendering, cinematic lighting, and stylistic nuance. Here is how to design concrete evaluation matrices for production workloads: Production Workflow Primary HEIM Focus Prompt Strategy & What to Look For E-Commerce & Digital Merchandising Image-Text Alignment + Reasoning + Efficiency Test : Product packaging with exact textual labeling, studio lighting setups, and multi-object product kits. Observe : Crispness of typography without character bleeding; accurate shadow projections corresponding to simulated light sources. Game Concept Art & Storyboarding Aesthetics + Originality + Robustness Test : Dense multi-layered scenes (e.g., cyberpunk street market with rain reflections and foreground protagonists). Observe : Depth of field, geometric consistency across complex occlusions, and lack of visual repetition. Corporate Stock & Workplace Avatars Bias + Fairness + Image Quality Test : Neutral prompts like "A senior software architecture team conducting a code review in an open office." Observe : Realistic skin tones, natural lighting, and organic diversity without stereotypical exaggerations. Global Localization & Marketing Assets Multilinguality + Knowledge + Toxicity Test : Non-English cultural expressions (e.g., traditional Japanese tea ceremonies or Brazilian Carnival celebrations). Observe : Does the engine respect authentic cultural nuances, or does it apply generic stereotypical tropes? 4. Engineering Takeaways for Your Team To implement an effective image evaluation pipeline inside your organization: Enforce Controlled Variables : Always standardize aspect ratios (1:1 1:1 , 3:2 3:2 , etc.), resolution steps, and seed control when comparing candidates. A model running at an unsupported native resolution will trigger runtime scaling that corrupts detail benchmarking. Combine Metric Automation with Blind Human Review : Automate objective metrics: Latency tracking, CLIP score for semantic alignment, and safety classification scans. Calibrate human judgment: Implement a standardized 1−5 1−5 Likert scale (1=Unusable 1=Unusable , 3=Baseline Acceptable 3=Baseline Acceptable , 5=Production Ready 5=Production Ready ) with blinded model outputs to remove vendor bias. Isolate Secrets & Test Data : Follow the pattern of the online lab—keep API keys volatile in memory per session, avoiding persisted storage leaks when evaluating third-party endpoints. Conclusion The shift from experimental AI to mission-critical infrastructure demands engineering rigor. We can no longer rely on sporadic gallery showcases. By embracing holistic evaluation frameworks like HEIM and systematically validating models against your specific production scenarios, you can objectively navigate model trade-offs—delivering visual applications that are stunning, consistent, secure, and cost-effective. Please try this https://aka.ms/imagebench

How to turn your Bicep modules into documentation with bicep docs generate

Mon, 21 Sep 2026 03:28:12 +0000

Turn Bicep modules into Markdown documentation with the experimental docs generate command and customizable Scriban templates. Read the full article here: How to turn your Bicep modules into documentation with bicep docs generate

You Get One Exchange Left: Rethinking Azure Commitments Before February 2027

Mon, 21 Sep 2026 00:03:58 +0000

Azure gives you two main ways to pay less by committing up front. A reservation gets you the deepest discount, but you are locking in a specific SKU in a specific region. A savings plan gives up some of that discount in exchange for freedom: you are only committing to spend a certain amount per hour on compute and database services, and it does not care which region you spend it in. Until now, a reservation could move with you. If your infrastructure or database environment changed, or a workload had to move to a new region, you exchanged the reservation for one that matched where things had landed. That flexibility is why teams could commit early and adjust as the environment evolved. That flexibility is changing . From February 1, 2027, you can no longer exchange a reservation for any service that a savings plan covers. Neither product is changing. What is changing is how much room you have to adjust a commitment after your environment shifts, which means the order you make these decisions in matters a lot more than it used to. What's changing Here is what is affected as of the announcement. Compute: Azure Virtual Machines (including swapping between non-premium and premium storage), Azure Dedicated Host, and Azure App Service. Databases: Azure Database for PostgreSQL, Azure Database for MySQL, Azure DocumentDB, Azure Cosmos DB, Azure SQL Database, and Azure SQL Managed Instance. That list will grow. As savings plans start covering more services, reservations for those services automatically fall under the same rule. Products that are being retired are excluded, and so are clouds where savings plans are not offered. Two details really matter. If you own a reservation for one of these services and you bought it before February 1, 2027, you get one final exchange after that date. Just one. Buy on or after that date and you get none. Full details, including the FAQ, are in the official announcement: " Reservation exchanges for Azure services covered by savings plans end starting Feb. 1, 2027 ". Figure 1. Reservation exchange rights before and after 1 February 2027. What's staying exactly the same This is worth spelling out, because it is easy to read more into the announcement than is actually there. All of this still works. VM instance size flexibility is untouched. Cancelling a reservation is untouched. Trading a reservation in for a savings plan is still there. Buying and renewing reservations is still available, and still the right call for steady workloads. Reservations are not going anywhere. The only thing changing is your ability to swap one for another when your environment moves underneath it. The part most teams get backwards You cannot think clearly about timing without this, and it is the thing people most often have wrong: reservations and savings plans are not a choice between two options. You can use both. They stack, and they apply in a set order every hour. Reservations go first, on anything they match. The savings plan picks up what is left, up to your hourly commitment. Whatever is still uncovered bills at pay-as-you-go, using your negotiated rate. Here is one hour, made concrete. Say you have reservations covering $10 an hour of matching VMs, plus a savings plan committed at $5 an hour. In an hour where you use $18 of eligible compute, $10 gets reservation pricing, $5 gets savings plan pricing, and the last $3 bills pay-as-you-go. The savings plan did not fight the reservation for that spend. It caught the overflow. Figure 2. How one hour of eligible compute is billed when you hold both instruments. Two things people assume that are not true. The terms do not have to match: a three-year reservation and a one-year savings plan work fine side by side. And you do not tag or assign anything. Once you buy a savings plan, it looks across whatever scope you bought it at and applies itself wherever it finds a fit. That flexibility is the whole point. A savings plan ties you to an hourly amount, not to a SKU or a region. A reservation ties you to both. Before February 2027 that difference was mostly about how big a discount you got. After, it also decides how easily your commitment can follow the environment as it changes. Three rules for buying from here on Lean on savings plans while things are still moving Before you commit to anything, ask what is going to change in the next ninety days. If a team is midway through centralizing their networking and is about to delete every per-subscription VPN gateway, any recommendation you generate this week will be wrong next month. Azure Advisor rescans every day and rewrites its recommendations as your environment shifts. If a workload is mid-migration, mid-consolidation, or mid-anything, a savings plan gets you a similar discount without locking you in. Move it to a reservation once it is genuinely settled. A domain controller running around the clock in one region is the textbook reservation. Something still being actively built is not. Start short, and know why that matters now Three years gets you the best rate. Starting with one year and extending as you get more confident was always the sensible approach. Now it carries more weight, because a reservation can no longer be exchanged when your environment moves. If one stops matching, your options are to cancel it under the existing policy, or trade it in for a savings plan. That is the whole list. Buy at the business-unit level, not the tenant level Buy everything centrally and you take away each team's ability to pick what suits their own workloads. Then, when a team wants more coverage than the central purchase gives them, they go and buy their own at subscription level, and now you are paying for the same thing twice. Buying per business unit also makes chargeback far easier, because the discount ends up sitting where the spending happens. Figure 3. Matching the commitment instrument to how settled the workload is. Clean up before you commit There is a step that comes before all of this, and it is not new advice. Azure Advisor already flags unattached disks, idle virtual network gateways, and VMs that should be resized or switched off. If you have not done that sweep, " Identify your savings potential in Azure " walks through the tools properly. What is new is what happens if you skip it. Leftover and idle resources do not just eat into your savings. They inflate the number you size your commitment against. Commit against a messy environment and you have just locked in one to three years of spend on resources that should not be running. Up to now, an exchange gave you a way to adjust that later. Cleaning up used to be good housekeeping. Once you cannot exchange out of a reservation, it is genuinely about limiting risk. The same goes for the workloads you are keeping. Switch off VMs outside business hours before you buy a reservation, not after. Reservations only pay off on workloads that run constantly, and once you have bought one you owe the money whether the VM is running or deallocated. Scaling up and never scaling back down is the same problem wearing a different hat. How to check it actually worked Your reservation and savings plan discounts show up on the invoice under amortized cost. Three columns tell the story. Pay-as-you-go price is the list price. Unit price is your negotiated discount, before reservations are applied. Effective price is what you genuinely paid once reservations and savings plans were counted. There is no neat query for this. You read it off the invoice. It is the clunkiest part of the whole process and it is the first thing your finance partner will ask about, so get it into your reporting now rather than during your first chargeback cycle. What to do in the next ninety days List every active reservation you hold for an affected service. Work out which ones no longer match the workload. Those are your candidates for that one remaining exchange. Decide deliberately where that one exchange does the most good . Clean up orphaned disks, idle gateways, over-replicated storage, and scale-ups nobody scaled back down. Re-baseline your commitment sizing against the tidied-up environment. Buy at business-unit level, leaning toward savings plans anywhere the workload is still changing. The takeaway Reservations and savings plans both still work, and both still save you real money. What changes on February 1, 2027 is that a reservation can no longer be exchanged when your environment moves, so the decision has to be right at the point you make it rather than adjusted afterwards. That puts the weight on sequence: clean up first, size the commitment against what is actually running, use savings plans while a workload is still settling, and move to a reservation once it has stopped moving. The deadline is not something to panic about. It is a good excuse to finally do the bit most cost programs skip.

Summary and next steps

Sun, 20 Sep 2026 10:14:44 +0000

[!NOTE] Work in progress. This course hasn't been released yet, so there's nothing to work through on this page today. In the meantime, Migrate from PowerShell DSC to Microsoft DSC is finished and waiting. Subscribe below and you'll get a note the day this Read the full article here: Summary and next steps

Knowledge check

Sun, 20 Sep 2026 10:14:25 +0000

Pitfals from the field

Sun, 20 Sep 2026 10:13:59 +0000

Prove equivalence end to end

Sun, 20 Sep 2026 10:13:42 +0000

Migrate credentials

Sun, 20 Sep 2026 10:13:04 +0000

Reboots and cross-node coordination

Sun, 20 Sep 2026 10:12:45 +0000

Own the enforcement schedule

Sun, 20 Sep 2026 10:12:13 +0000

Map LCM features to Microsoft DSC

Sun, 20 Sep 2026 10:11:47 +0000

Introduction to replacing the LCM

Sun, 20 Sep 2026 10:11:18 +0000

Summary

Sun, 20 Sep 2026 10:09:15 +0000

Knowledge check

Sun, 20 Sep 2026 10:08:29 +0000

Path D: Going native

Sun, 20 Sep 2026 10:07:39 +0000

Rewrite AppEnvironment as a class

Sun, 20 Sep 2026 10:07:20 +0000

Path C: From script-based to class-based

Sun, 20 Sep 2026 10:06:47 +0000

Convert a MOF file

Sun, 20 Sep 2026 10:06:20 +0000

Path B: Import your compiled MOFs

Sun, 20 Sep 2026 10:05:40 +0000

Adapt the legacy configuration

Sun, 20 Sep 2026 10:05:13 +0000

Path A: Adapt in place

Sun, 20 Sep 2026 10:04:29 +0000

Microsoft Azure (Cloud) Solutions Architect - Folge 73 - Microsoft Purview: Der Security-Geheimtipp🔒

Sun, 20 Sep 2026 03:00:21 +0000

Warum Datenschutz nicht nur in Ihrem Prüfungsordner, sondern auch in Ihrer Sicherheitsarchitektur und Ihrem Unternehmensrisikomanagement seinen Platz hat. Links: https://github.com/tomwechsler/Online_Workshops https://github.com/tomwechsler/Online_Workshops/blob/main/Microsoft_Cloud_Architect/README.md #MicrosoftPurview #DataSecurity #DLP

Introduction to migration configurations and resources

Sat, 19 Sep 2026 12:33:58 +0000

Read the full article here: Introduction to migration configurations and resources

Summary

Sat, 19 Sep 2026 11:33:46 +0000

Read the full article here: Summary

Knowledge check

Sat, 19 Sep 2026 11:22:03 +0000

Answer the questions, then expand each answer to check yourself. 1. A resource appears in the output of dsc resource list --adapter Microsoft.Adapter/WindowsPowerShell but not in dsc resource list --adapter Microsoft.Adapter/PowerShell. What does that most likely mean? * A. The resource is broken and needs to be Read the full article here: Knowledge check

Choose a migration path

Sat, 19 Sep 2026 11:07:54 +0000

Read the full article here: Choose a migration path

Presenting at JNUC 2026: Identity-Aware Cloud Infrastructure and Jamf

Sat, 19 Sep 2026 05:17:57 +0000

I’m excited to share that I’ll be speaking at JNUC 2026 in Kansas City, Missouri! My session is titled Identity-Aware Cloud Infrastructure: Securing Azure & AKS with Jamf Connect ZTNA and Jamf Trust. If you work in cloud operations, security, or platform engineering, you’ve likely seen this challenge firsthand: while organizations have made huge strides ... Read more

New Course Coming Soon: Integrating AI Agents in Enterprise Systems

Sat, 19 Sep 2026 05:00:44 +0000

I’m pleased to share that I’m partnering with Pluralsight again, this time on a course called Integrating AI Agents in Enterprise Systems. It’s part of a new path on Agentic AI Integration for Developers, and...

Build and inventory the Bindery estate

Sat, 19 Sep 2026 04:11:05 +0000

Read the full article here: Build and inventory the Bindery estate

Inventory what you have

Sat, 19 Sep 2026 04:01:51 +0000

Read the full article here: Inventory what you have

Why migrate, and when not to

Sat, 19 Sep 2026 03:46:09 +0000

Before touching a single file, it's worth being honest about the motivation. PowerShell DSC still works. Windows PowerShell 5.1 ships with Windows, the LCM still enforces configurations, and Start-DscConfiguration still does what it always did. Nobody is going to reach into your servers and delete it. Read the full article here: Why migrate, and when not to

Introduction to migrating from PowerShell DSC

Sat, 19 Sep 2026 03:20:00 +0000

Everything most DSC tutorials teach you assume that you're starting from a fresh clean machine, a new configuration document, and the latest resources. That's rarely the reality. If you've been working with PowerShell DSC for years, you have an estate. Folders full of Configuration Read the full article here: Introduction to migrating from PowerShell DSC

Microphone and Camera Streaming for Mixed Reality Link

Fri, 18 Sep 2026 20:44:23 +0000

Our latest release of Mixed Reality Link introduces new ways to connect your mixed reality headset with your Windows PC. With this update, your headset becomes more than just a display. You can now use its built-in microphone and cameras directly with Windows, making it easier to communicate, collaborate, and share your perspective with others. Use Your Headset's Microphone Whether you're joining a Teams meeting, playing a game, chatting with friends, or speaking with an AI assistant, your voice can now come directly from your mixed reality device. This creates a more natural experience by letting you speak through the device you're already wearing, without needing a separate microphone connected to your PC. Share Your Perspective Your headset's front-facing camera can now be used by Windows applications, making it easier to share what you're seeing with others. Instead of describing what you're looking at, you can show it directly from your point of view. Appear as Your Meta Avatar The new Avatar Camera lets Meta Quest users appear as their avatar in Windows. Instead of turning on a webcam, you can use your Meta avatar as a camera source and maintain your presence in meetings and conversations. Getting Started These features are available in Mixed Reality Link version 26.9105.9070.0 and later. To get started, connect your headset to your PC through Mixed Reality Link . Once connected, you'll find new microphone and camera sources available in Windows that can be selected just like any other input device. Available sources include: Mixed Reality Link Microphone for audio input Mixed Reality Link Passthrough for headset camera input Mixed Reality Link Avatar Camera for Meta avatar video Simply select the device you want to use within your application and start using these new capabilities. We'd love to hear about your experience. Share your feedback, suggestions, and questions in the Mixed Reality Link Tech Community .

IPv6 hub-and-spoke network topology

Fri, 18 Sep 2026 20:11:02 +0000

Learn how to transition a hub-and-spoke network topology in Azure so it supports IPv6, which creates a dual-stack network.

Speaking at Afrofest Tech Day: AI The Bigger Picture

Fri, 18 Sep 2026 19:34:45 +0000

Friday, September 18, I’ll be speaking at Afrofest Tech Day in Golden Valley, Minnesota. I’m looking forward to joining other technology leaders, entrepreneurs, professionals, and members of the community for a day focused on innovation, technology, and opportunity. My session is titled “AI The Bigger Picture” AI continues to dominate conversations across nearly every industry. ... Read more

Title Plan Update - September 18, 2026

Fri, 18 Sep 2026 19:18:28 +0000

📁 September 18, 2026 - Title Plan Now Available Access the latest Instructor-Led Training (ILT) updates anytime at http://aka.ms/Courseware_Title_Plan to ensure you're always working from the most current version. 📌 Reminder: To help you stay informed more quickly and consistently, we’ve moved to a weekly publishing cadence for the title plan. This means each update may include fewer changes but ensures you’re always up to date.

[In preview] Public Preview: Foundry Routines in Foundry Agent Service

Fri, 18 Sep 2026 19:10:53 +0000

In public preview, Foundry Agent Service adds Foundry Routines, a native trigger primitive for running published agents automatically. Production agents often need to run on a schedule or when a business event occurs, and today that means assembling exter

A2A Endpoints and A2A Tool in Microsoft Foundry agents

Fri, 18 Sep 2026 19:00:00 +0000

Agent-to-agent collaboration just became much easier to build in Microsoft Foundry. The A2A Tool and incoming A2A endpoints support A2A protocol version 1.0, which is generally available. The earlier a2a_preview tool type and protocol version 0.3 remain available in preview for existing integrations. Hosted Agents can also consume A2A tools through Foundry Toolboxes exposed over MCP. If you have been following earlier previews, A2A Endpoints were previously known as the A2A API head . The idea is simple: A2A Endpoint : expose a Foundry agent so an external agent can discover and invoke it. A2A Tool : let a Foundry agent invoke another A2A-compatible agent. Hosted Agents : use the A2A Tool through a Foundry Toolbox exposed as an MCP endpoint. Together, these capabilities make it possible to build multi-agent systems where agents can specialize, publish their skills, and securely collaborate across service boundaries. Why this matters Until now, many multi-agent patterns required custom APIs, one-off adapters, or orchestration logic tightly coupled to a specific framework. A2A gives us a standardized protocol for agent-to-agent communication. That means one agent can ask another agent for help without needing to know its implementation details. The caller discovers the remote agent’s capabilities through an agent card , sends a task through the A2A protocol, and receives a response it can incorporate into the conversation. For Foundry-hosted A2A endpoints, discovery is authenticated. The agent-card URLs and protocol endpoint require Microsoft Entra ID authentication and are not publicly accessible. For example: A support agent can call a billing agent. A research agent can call a data-analysis agent. A Foundry-hosted enterprise agent can call a specialized agent running outside Foundry. A Hosted Agent can call a Foundry Toolbox that wraps an A2A connection. Architecture 1: External agent calls a Foundry agent through an A2A Endpoint In this pattern, a Foundry agent is exposed as an A2A endpoint. An external agent discovers the agent card and invokes it using the A2A protocol. An external agent discovers a Foundry agent through its agent card, invokes it using A2A protocol v1.0, and receives a response generated with Foundry tools, data, and models. The Foundry agent processes the request using its configured models, instructions, tools, and enterprise data sources, and then returns the response to the calling agent. A Foundry prompt agent must support the Responses protocol before it can be exposed through an incoming A2A endpoint. The Foundry agent exposes an A2A base URL in the following format: https://{account}.services.ai.azure.com/api/projects/{project}/agents/{agent}/endpoint/protocols/a2a The version-specific agent-card URLs follow these patterns: https://{account}.services.ai.azure.com/api/projects/{project}/agents/{agent}/endpoint/protocols/a2a/agentCard/v1.0 https://{account}.services.ai.azure.com/api/projects/{project}/agents/{agent}/endpoint/protocols/a2a/agentCard/v0.3 For new integrations, target A2A protocol v1.0 , which is GA. Foundry also supports v0.3 for existing preview integrations, but v1.0 is the recommended path forward. Foundry serves both protocol versions through the same A2A base path. The caller selects the version through agent-card negotiation, the A2A-Version header, or the a2a-version query parameter. Production clients should explicitly negotiate or request version 1.0 rather than relying on the default behavior. Foundry’s incoming A2A v1.0 endpoint uses JSON-RPC. Incoming A2A v0.3 supports JSON-RPC and HTTP+JSON, but v0.3 remains in preview. Only text modality is supported, and streaming responses are not supported. Architecture 2: Foundry agent calls another agent using the A2A Tool The reverse pattern is just as important. A Foundry agent can use the A2A Tool to call another A2A-compatible endpoint. A RemoteA2A project connection stores the remote A2A base URL and its authentication configuration. The A2A Tool references the connection and specifies the A2A protocol version to use. Foundry resolves the default agent-card path automatically and negotiates the A2A protocol version. You do not need to configure send_credentials_for_agent_card for a Foundry agent target. First, set the active Foundry project. Then create the RemoteA2A connection. PROJECT_ENDPOINT="https://{account}.services.ai.azure.com/api/projects/{project}" azd ai project set "$PROJECT_ENDPOINT" azd ai connection create my-a2a-connection \ --kind remote-a2a \ --target "https://{account}.services.ai.azure.com/api/projects/{project}/agents/{agent}/endpoint/protocols/a2a" \ --auth-type agentic-identity \ --audience "https://ai.azure.com" The target Foundry project or agent must grant the calling agent identity the Foundry Agent Consumer role, or another role that contains the required endpoint permissions. When assigning the role, use the calling identity’s Microsoft Entra object or principal ID, not its application or client ID. A role assignment can be created at either the target project scope or the individual agent scope: az role assignment create \ --assignee-object-id "{calling-agent-principal-object-id}" \ --assignee-principal-type "ServicePrincipal" \ --role "eed3b665-ab3a-47b6-8f48-c9382fb1dad6" \ --scope "{target-project-or-agent-resource-id}" Agent identities and managed identities are represented as service principals in Microsoft Entra ID, which is why ServicePrincipal is used as the principal type. Architecture 3: Hosted Agent uses A2A through a Foundry Toolbox Hosted Agents can use A2A by attaching a Foundry Toolbox. The toolbox contains an A2A Toolbox Tool and exposes it through an MCP-compatible endpoint. The complete interaction flow is: The Hosted Agent connects to the Foundry Toolbox over MCP. The Hosted Agent authenticates to the toolbox using Microsoft Entra ID. The toolbox invokes its configured A2A Toolbox Tool. The A2A Toolbox Tool references a RemoteA2A project connection. The RemoteA2A connection identifies the destination and downstream authentication configuration. The toolbox invokes the remote agent through the A2A protocol. The result is returned to the Hosted Agent through the toolbox’s MCP endpoint. Hosted Agents securely invoke remote A2A agents through a Foundry Toolbox and RemoteA2A project connection. This creates a two-hop architecture: Hosted Agent to Foundry Toolbox over MCP, followed by Foundry Toolbox to the remote agent over A2A. The toolbox MCP endpoint used by the Hosted Agent follows this format: https://{account}.services.ai.azure.com/api/projects/{project}/toolboxes/{toolbox-name}/versions/{version}/mcp?api-version=v1 A version-specific toolbox endpoint can also be used when the Hosted Agent must remain pinned to an immutable toolbox version. The Hosted Agent authenticates to the toolbox using Microsoft Entra ID and the following scope: https://ai.azure.com/.default The Hosted Agent authenticates to the Foundry Toolbox MCP endpoint using Microsoft Entra ID. For direct token acquisition, use the https://ai.azure.com/.default scope. Downstream credentials, secrets, managed identity settings, and OAuth configuration should remain in the RemoteA2A project connection rather than being embedded in the Hosted Agent’s code. Authentication is the design decision The most important architecture choice is authentication. A2A supports different patterns depending on whether the calling agent should act as itself or on behalf of the user. RemoteA2A connection authentication options Auth type Use when none The remote endpoint does not require auth. Rare for production. custom-keys The endpoint expects an API key, PAT, bearer token, or custom header. oauth2 Each user authorizes access through an OAuth 2.0 consent flow. Use this when the downstream action must preserve the user’s individual permissions. user-entra-token The user’s Microsoft Entra identity should flow to the remote service. project-managed-identity All agents in the project should share the project identity. agentic-identity For service-to-service calls using an agent identity, service principal, or managed identity, use as the role-assignment principal type. For incoming A2A Endpoints on Foundry agents , authentication is stricter: Incoming A2A requires Microsoft Entra ID authentication . Key-based and unauthenticated incoming access are not supported. The caller must have Foundry Agent Consumer or another role that grants endpoint access. Access can be granted at the project scope or individual agent scope. Calls can use either on-behalf-of user identity or a service identity such as an agent identity, service principal, or managed identity. Use OAuth or user identity passthrough when the remote action must respect each user’s permissions. What you configure To expose a Foundry agent as an A2A Endpoint, you configure two things: An agent card , describing the agent’s capabilities. The A2A protocol on the agent endpoint. The relevant portion of the agent PATCH request body looks like this: { "agent_card": { "description": "A specialist agent that answers questions about invoices.", "version": "1.0", "skills": [ { "id": "invoice-lookup", "name": "Invoice lookup", "description": "Finds and summarizes invoice status." } ] }, "agent_endpoint": { "protocol_configuration": { "responses": {}, "a2a": {} } } } Agent cards for prompt agents in Foundry can also be configured directly in the portal. Then another agent can call it via Tools using the agents A2A endpoint. A2A Endpoint for an agent in Foundry Agent card configuration for a Foundry agent Final thoughts A2A Endpoints and the A2A Tool make Foundry agents composable. Instead of building one large agent that knows everything, you can build focused agents that publish capabilities and collaborate securely. Use A2A Endpoints when you want other agents to call your Foundry agent. Use the A2A Tool when your Foundry agent needs to call another agent. For Hosted Agents, use a Foundry Toolbox to bring A2A into the hosted runtime cleanly. Learn more: A2A authentication: https://learn.microsoft.com/en-us/azure/foundry/agents/concepts/agent-to-agent-authentication A2A Tool: https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/tools/agent-to-agent A2A Endpoint: https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/enable-agent-to-agent-endpoint

Two modes combined: Windows Admin Center version 2610 is now in public preview!

Fri, 18 Sep 2026 18:09:48 +0000

We’ve been working on something big, and now we’d like to share it with you and get your feedback before we release to general availability. The time has come—we’ve combined Windows Admin Center: Administration Mode (aMode) and Windows Admin Center: Virtualization Mode (vMode) into a single installer. Only one mode can be selected per installation, and we don’t support having both modes installed on the same machine. New features in vMode now available include Azure Arc onboarding, backup and restore, certificate lifecycle management, and more. As with all our releases, we’ve also made bugfixes to improve your overall experience. Thank you to our customers, partners, and fans for helping us to continue to improve and make Windows Admin Center better! Download the preview build today and leave us feedback on our GitHub . What’s new in Windows Admin Center 2610 (preview) Platform Combined mode installer Windows Admin Center now provides a unified installer experience for both Administration Mode (aMode) and Virtualization Mode (vMode). Administrators can deploy and configure their preferred management mode from a single installation workflow, reducing setup complexity and streamlining deployment. Simplified installation experience with a single installer Faster deployment and onboarding for new environments Reduced administrative overhead when evaluating or adopting vMode Consistent setup and configuration workflow across Windows Admin Center management experiences The combined installer helps organizations get started more quickly while providing a more streamlined path to advanced virtualization management capabilities. New Azure registration experience With this release, we’ve redesigned the gateway Azure registration experience. It’s now easier than ever to connect Windows Admin Center to Azure with just a few clicks. We’ve reduced the setup friction by requesting only the permissions needed for the current user and registration task. This new flow does not require tenant-level administrator consent, so teams no longer need to coordinate with a highly privileged tenant administrator before getting started. Administrators can further restrict who can perform Azure operations in Windows Admin Center by assigning appropriate permissions through Azure role-based access control (Azure RBAC). Access this new experience by navigating to your Windows Admin Center gateway settings and selecting the Register tab. Key bug fixes Fixed an issue where the installer was failing with “RegCreateKeyEx failed, code 5” (reported in the comments of the last generally available Windows Admin Center release) Virtualization mode Haven't been following Windows Admin Center: Virtualization Mode? Read our blog series , documentation , and be sure to check out the release notes for our previous previews before you get started. Update on the VM Conversion tool Microsoft is aware of a change Broadcom has made affecting the availability of the VMware Virtual Disk Development Kit (VDDK) package required by the preview VM Conversion extension in Windows Admin Center. We are actively evaluating options to continue supporting customers desire to migrate away from Broadcom. However, at this time we do not have an alternative available and would recommend customers discontinue evaluation of the preview VM Conversion tool until we can provide an update. As the options under evaluation all require significant rework of the extension’s implementation, we have removed the extension from the extension feed. Customers who need to proceed with migrations can consider System Center Virtual Machine Manager (SCVMM) for migrations to Windows Server with Hyper-V, or Azure Migrate (agent-based) for migrations to Azure. We hope to provide you with another update soon. Azure Arc onboarding Connecting your virtualization environment to Azure is now easier than ever. vMode provides a streamlined Azure Arc onboarding experience that helps administrators quickly register and connect their infrastructure to Azure while minimizing setup complexity. By onboarding through Azure Arc, organizations can extend their hybrid management capabilities, gain greater visibility into their infrastructure, and take advantage of Azure-powered services and experiences directly from their connected environment. Key benefits: Faster onboarding to Azure Arc Simplified hybrid infrastructure management Enhanced visibility across on-premises and Azure resources Access to Azure-integrated management and operational services Add resource Networking improvements We've made several improvements to the networking experience in vMode to make it easier to configure, validate, and troubleshoot networking when adding resources. Improved network intent status visibility The Networking page in the Add Resource workflow now displays the status of existing network intents detected on your hosts. You can review intent health, identify configuration issues earlier in the onboarding process, and troubleshoot intents that need attention. Refresh networking state without restarting the workflow If you make networking changes directly on a host while adding a resource, you can now refresh the Networking page to retrieve the latest configuration without exiting and restarting the Add Resource workflow. This makes it easier to resolve networking issues and continue onboarding from where you left off. Storage VLAN override support Storage network intent templates now support storage VLAN overrides, giving you more flexibility when configuring storage networks that require VLAN settings that differ from the defaults defined by the intent template. More flexibility for external storage deployments The Add Resource workflow no longer requires a storage intent for deployments using external storage. Customers who rely on dedicated storage networking can continue to configure storage intents as needed, while external storage deployments can onboard without configuring a storage intent. Improved networking diagnostics We’ve also made it easier to troubleshoot networking issues by including Network ATC Event Logs in vMode Agent logs, providing additional diagnostic information when investigating network intent configuration or validation issues. Resume/retry functionality After you begin adding a resource to be managed through vMode, transient issues like loss of connectivity or configuration changes can cause your workflow to fail. Previously, we required you to clean up the workflow and completely restart, going through the Add Resource wizard again. Now, we’ve added the ability to resume workflow steps (in the case of service disruption) and retry steps have failed, as long as rerunning the step won’t disrupt anything else in the wizard. As part of workflow feature expansion work, we’ve also made two changes to our deployment process. When you begin to deploy your machine to vMode, it will immediately be added to the navigation hierarchy. If you select your object before it’s ready, you’ll be able to see the status of its deployment, similar to how it appears in the workflow status pane. That way if you don’t make it back to the workflow for a while, you’ll know where to find the information you need to get started or rectify any issues if they occur during deployment. Backup and restore Protect and recover your vMode environment with built-in backup and restore capabilities. Backup packages capture critical vMode management data, including virtualization inventory, cluster metadata, gateway configuration, certificates, RBAC settings, templates, and operational state, helping ensure business continuity and disaster recovery readiness. With restore support, administrators can recover a vMode deployment after infrastructure failures, configuration errors, or migration scenarios. Restored environments retain key management settings and virtualization metadata, reducing recovery time and simplifying operational continuity. Certificate lifecycle management vMode uses certificates to help secure communication and establish trust between the Windows Admin Center gateway and managed hosts. Self-signed certificates are a great fit for testing because they can be generated quickly without requiring an existing certificate authority or PKI configuration. This makes it easier to evaluate vMode deployment workflows and validate connectivity in non-production environments. For production environments, however, we now support managing vMode certificates through Active Directory Certificate Services (AD CS) for stronger governance and scalability. Centralized issuance and certificate templates help administrators control certificate configuration and align deployments with existing PKI policies. AD CS also integrates certificates with the organization’s established trust infrastructure. Automated renewal and consistent lifecycle management improve auditing and reduce the risk of service interruptions caused by expired certificates. To configure your Windows Admin Center gateway to manage certificates using AD CS, navigate to your gateway settings and select the Certificates tab. Detailed documentation on how to configure certificate templates for use with autorenewal is coming soon. Live migration Live migration is a critical virtualization capability that allows a running virtual machine to move from one physical host to another with little or no downtime. This enables administrators to perform hardware maintenance, apply updates, balance workloads, and respond to failures without disrupting applications or users. By eliminating the need to shut down VMs during these operations, live migration improves availability and helps organizations meet business continuity and service-level objectives. It is a foundational technology for highly available and flexible virtualized environments. Making the live migration experience in the virtual machines tool aware of your vMode managed machines is a small step towards making your virtualization management experience easier than ever. To try it out, navigate to the Virtual Machines tool, select a VM, and then select Manage > Move . Key bug fixes The GPU tool is now available in vMode Improved agent logging Agent health indicators are now visible in navigation hierarchy Other improvements New SDK—now with React support The Windows Admin Center SDK has been updated to version 6.0.0! This new version features two major updates: commands for upgrading existing Windows Admin Center extensions to Angular 20 as well as commands for creating and testing React-based Windows Admin Center extensions. The documentation for preparing your development environment and creating a tool extension has been updated to reflect these changes. Known issues The following issues about this build are known and actively being addressed: [vMode] The Azure Arc-enabled status table may appear inaccurate when collapsed. [vMode] Some links within tool extensions may redirect you to an aMode interface. [both modes] When performing VM live migration, the operation may fail if the source and target nodes have different authentication methods. Happy testing, Davanna and the Windows Admin Center team

FinOps-Ready Azure Landing Zone - Part 2

Fri, 18 Sep 2026 17:30:45 +0000

Author's Note: Vendor names referenced in this article are used solely as illustrative architectural examples and should not be interpreted as endorsements, recommendations, or advertisements. Introduction In Part 1, we looked at how Azure-native services can establish the foundation for a FinOps-ready Azure Landing Zone. Azure provides a strong set of capabilities for governance, monitoring, security, and cost management through services such as Azure Policy, Azure Monitor, Azure Cost Management, Azure Advisor, Microsoft Entra ID, and Log Analytics. Building a FinOps-Ready Azure Landing Zone: Infrastructure Foundations for Cost Optimization | Microsoft Community Hub Learn how to design and automate a FinOps-ready Azure Landing Zone with tagging enforcement, budgets, policy controls, and centralized cost visibility. This... techcommunity.microsoft.com For many organizations, these capabilities are more than sufficient. However, as an Azure estate grows across multiple subscriptions, applications, regions and business units, the challenge often changes. It is no longer simply: “Can Azure monitor this resource?” Instead, teams need to understand which business application a resource belongs to, who owns it, what dependencies are affected, which team should receive an alert, whether known problems can be remediated automatically, and how much the application actually costs. This is where additional management and operational platforms can complement Azure-native capabilities. One example is Turbo360. The objective here is not to replace Azure-native services, but to explore where an additional operational layer can simplify management of a large Azure estate. 1. Azure Native Services Remain the Foundation A good enterprise architecture should continue to use Azure-native capabilities as the foundation. Azure Policy → Governance and compliance Azure Monitor → Metrics, logs and monitoring Log Analytics → Centralized telemetry and analysis Azure Cost Management → Cost visibility and budgets Azure Advisor → Recommendations Azure Automation / Logic Apps / Functions → Automation and remediation Microsoft Entra ID + Azure RBAC → Identity and access These services should not disappear simply because an organization introduces another management platform. Instead, an additional platform can provide a higher-level operational experience across these capabilities. 2. The Difference Between Resource Monitoring and Application Monitoring One of the biggest challenges in large Azure environments is the difference between resource-centric monitoring and application-centric monitoring. Azure Monitor naturally provides visibility into individual Azure resources: Virtual Machine Storage Account SQL Database Service Bus App Service Key Vault Application Gateway But a business application may depend on all of them: Customer Application | +----------------+----------------+ | | | App Service SQL Database Service Bus | | | +----------------+----------------+ | Key Vault An engineer may know that a particular Service Bus or SQL Database is unhealthy. The more important question from an operations perspective is: Which application is affected? Platforms such as Turbo360 may provide application-centric monitoring approaches where Azure resources can be grouped into logical business applications, enabling consolidated health views and dependency visibility. 3. Consolidating Monitoring Across Subscriptions Enterprise Azure environments rarely consist of a single subscription. A typical environment might look like: Management Group │ ├── Production │ ├── Application Subscription │ ├── Data Subscription │ └── Integration Subscription │ ├── Non-Production │ ├── Development │ ├── Test │ └── UAT │ └── Shared Services ├── Networking ├── Security └── Monitoring Azure provides the mechanisms to manage these environments. However, operational teams may still need to move between resources, subscriptions and monitoring views when troubleshooting an application. An additional platform can provide a consolidated view across subscriptions and regions. Turbo360, for example, provides application-oriented views intended to consolidate health, topology and dependency information. 4. Alerting: From More Alerts to More Actionable Alerts Monitoring more resources does not necessarily mean better monitoring. A large Azure environment can generate a significant number of alerts. The challenge becomes: Which alerts actually require human attention? Detect ↓ Correlate ↓ Prioritize ↓ Route ↓ Remediate Operational platforms may provide capabilities such as consolidated alerting and automated alert configuration across monitored resources. The value is not simply “more alerts”; it is additional context around the alert. For example, instead of simply reporting “SQL Database CPU > 80%”, an operational view can associate the event with the Customer Order Application, its database dependency, and the potential application impact. 5. Automated Remediation Azure already provides several ways to automate remediation using services such as Azure Automation, Logic Apps, Azure Functions, Runbooks and Event Grid. An additional platform can simplify how an operational event is connected to a predefined remediation action. Some operational platforms, including Turbo360, support rule-triggered actions such as restarting resources, scaling resources, and executing custom runbooks. Application Monitoring ↓ Health Rule Triggered ↓ Determine Known Failure ↓ Automated Remediation ↓ Restart / Scale / Runbook ↓ Validate Health ↓ Close / Escalate The important architectural principle is: Automate deterministic problems, not unknown problems. Automation should be introduced based on risk, business impact and confidence in the remediation procedure. 6. Extending the FinOps Model Azure Cost Management provides the native foundation for understanding Azure expenditure. However, FinOps eventually becomes more than simply looking at the subscription bill. Azure Cost ↓ Subscription ↓ Business Unit ↓ Application ↓ Owner ↓ Optimization Opportunity Platforms such as Turbo360 may provide additional cost analysis capabilities including cost allocation, anomaly detection, rightsizing, and optimisation recommendations. This can help connect financial information with the infrastructure and application that generated the cost. For example, “Production subscription increased by 18%” is useful. But “The Customer Analytics application increased its compute cost by 18% because several resources are consistently under-utilized” is much more actionable. 7. Cost Anomaly Detection Budgets are useful, but they are not always sufficient. Consider a monthly budget of $100,000 with an alert threshold at 80%. By the time the 80% threshold is reached, a significant amount of unnecessary spending may already have occurred. Normal Spending Pattern ↓ Unexpected Deviation ↓ Anomaly Detection ↓ Owner Notification ↓ Investigation Platforms such as Turbo360 may provide anomaly detection capabilities intended to identify unusual Azure spending patterns and alert the appropriate stakeholders. A useful distinction is: Budget = “Are we approaching our planned limit?” Anomaly detection = “Is something unusual happening?” These are different questions. 8. Rightsizing and Waste Identification Another important FinOps concept is that resource health and resource efficiency are not the same thing. VM CPU utilization: 8% Memory utilization: 12% Availability: 99.99% From an availability perspective, everything looks excellent. From a FinOps perspective, the resource may be oversized. Some operational and FinOps platforms, including Turbo360, may provide rightsizing and optimisation capabilities that help identify under-utilised resources and potential cost-saving opportunities. These capabilities should complement native Azure recommendations rather than be positioned as a replacement for Azure Advisor. 9. Documentation as Part of the Landing Zone Documentation is often overlooked in cloud architecture. An Azure environment changes continuously. Resources are created, modified, migrated, deleted, reconfigured and reassigned. As a result, architecture diagrams and documentation can quickly become outdated. Architecture reviews Operational handover Audit preparation Disaster recovery documentation Support teams Environment discovery Turbo360 provides an Azure documentation capability that generates documentation from live Azure subscription information. The important concept is: Documentation should reflect the environment that actually exists, not only the environment that was originally designed. 10. Where Can an Additional Operational Platform Fit? Azure Landing Zone │ ┌─────────────────┼─────────────────┐ │ │ │ Governance Security Networking │ │ │ └─────────────────┼─────────────────┘ │ Azure Resources │ ┌─────────────────┼─────────────────┐ │ │ │ Azure Monitor Cost Management Azure Advisor │ │ │ └─────────────────┼─────────────────┘ │ Additional Operational Layer │ Turbo360 │ ┌─────────────────┼──────────────────┐ │ │ │ Application FinOps Operations Monitoring Insights Automation │ │ │ └─────────────────┼──────────────────┘ │ Business Outcomes The important architectural message is that an additional operational platform can sit above the Azure foundation rather than replace it. Turbo360 is one example of such a platform. The Azure-native services continue to provide the underlying governance, monitoring, security, automation, and cost-management capabilities. 11. When Is an Additional Platform Worth Considering? Not every Azure environment needs an additional management platform. For a small environment with a few subscriptions, limited applications, a small operations team, low resource count and simple monitoring requirements, Azure-native capabilities may be completely sufficient. The value proposition changes as the environment grows. Consider an additional operational layer when you start seeing: Hundreds or thousands of Azure resources Applications spanning multiple subscriptions Large operations teams Significant alert volumes Repetitive operational incidents Complex application dependencies Multiple FinOps stakeholders Requirement for application-level cost allocation Need for automated remediation Difficulty maintaining current documentation It is important to begin with Azure-native capabilities and introduce additional tooling only when there is a measurable operational, governance, observability, or FinOps requirement that cannot be efficiently addressed through native services alone. Additional platforms should be justified by clear business outcomes rather than feature availability alone. The decision should therefore be driven by operational complexity, not simply by the number of Azure resources. 12. A Balanced Architecture Decision From an Azure architecture perspective, evaluate Turbo360 using the same approach used for any additional platform: What does Azure already provide? Identify the native capability first. What operational problem are we trying to solve? Define the actual problem rather than starting with a product. Does the additional platform reduce complexity? If it introduces another dashboard without reducing operational effort, the value may be limited. Does it integrate with the existing Landing Zone? The platform should complement governance, identity, security and monitoring architecture. Can the additional capability be measured? Consider alert-noise reduction, MTTR, unused-resource reduction, improved cost allocation, faster incident triage and reduced documentation effort. Conclusion Azure provides a comprehensive set of native services for building and operating a Landing Zone. The opportunity with platforms such as Turbo360 is not necessarily to replace those services. Instead, the value can come from connecting the operational dots. Azure gives us the individual building blocks: Governance + Monitoring + Cost Management + Security + Automation. An additional platform can provide another abstraction layer: Application context + Consolidated visibility + FinOps insights + Operational automation. For organizations operating Azure at scale, this distinction can be valuable. The architectural principle to take away is: “Use Azure-native capabilities as the foundation. Add an operational platform only where it solves a clearly identified scale, visibility, automation or FinOps problem.” Jargon Buster FinOps : A practice for managing cloud spending collaboratively between engineering, finance and business teams. Azure Landing Zone : A standardized Azure foundation for deploying workloads with governance, identity, networking and security controls. Application-centric monitoring : Monitoring Azure resources in the context of the business application they support rather than viewing each resource independently. Resource-centric monitoring : Monitoring individual Azure resources such as VMs, databases, storage accounts and App Services. Alert fatigue : A situation where teams receive so many alerts that important events can be overlooked. MTTR (Mean Time to Resolution) : The average time required to restore service or resolve an operational incident. Rightsizing : Adjusting a resource to an appropriate size or configuration based on actual workload requirements. Cost anomaly : An unexpected deviation from a normal or expected spending pattern. Cost allocation : Associating Azure costs with a team, business unit, application, project or other ownership dimension. Automated remediation : Automatically performing a predefined corrective action when a known condition is detected. Abstraction layer : An additional layer that simplifies how users interact with underlying services without necessarily replacing those services. Editorial Note This article presents Turbo360 solely as an illustrative example of a third-party Azure operations and FinOps platform. The intent is to discuss architectural patterns, operational challenges, and potential solution approaches rather than recommend, endorse, or promote a specific product or vendor. Azure-native services remain the primary foundation for governance, monitoring, security, automation, and cost management within a FinOps-ready Azure Landing Zone. Any decision to adopt additional tooling should be driven by organisational requirements, operational complexity, governance standards, compliance considerations, and business objectives. Organizations should independently evaluate both native and third-party solutions using objective criteria such as functionality, operational impact, ease of integration, total cost of ownership, security, supportability, and measurable business value. Product capabilities referenced in this article should be validated against the latest vendor documentation, as features and services may evolve over time.

mssql-django 2.0: Now with mssql-python

Fri, 18 Sep 2026 17:30:00 +0000

mssql-django 2.0 is on PyPI. This release adds Microsoft's new mssql-python driver as a second way to connect, moves the supported Python, Django, and SQL Server versions forward, and fixes several connection and query bugs that production teams hit. pip install --upgrade mssql-django Pick your driver, one database at a time Until now, mssql-django spoke to SQL Server through pyodbc and an ODBC driver you installed yourself. That still works, and it's still the default. Version 2.0 adds a second path: mssql-python , Microsoft's Python driver for SQL Server. You choose per database alias. Add one option to the alias you want to move: DATABASES = { "default": { "ENGINE": "mssql", "NAME": "appdb", "HOST": "contoso.database.windows.net", "PORT": "1433", "OPTIONS": { "python_driver": "mssql_python", "extra_params": "Encrypt=yes", }, }, "reporting": { # No python_driver, so this alias stays on pyodbc. "ENGINE": "mssql", "NAME": "reportdb", "HOST": "contoso.database.windows.net", "PORT": "1433", "OPTIONS": { "driver": "ODBC Driver 18 for SQL Server", }, }, } ENGINE doesn't change. Remove the option and the alias is back on pyodbc. That's the whole rollback plan, which is the point: you can try the new driver on one database, run your test suite, and leave everything else alone. The mssql-python path covers the day-to-day work: connections, pooling, retries, transactions and savepoints, datetimeoffset values, introspection, and Microsoft Entra ID authentication. One practical difference worth calling out. On the mssql-python path, pip also installs the mssql-python-odbc companion package, which supplies Microsoft ODBC Driver 18 for SQL Server. There's no separate driver install, which takes a step out of container images and App Service deployments. Know what changes before you switch The two drivers aren't identical, and the differences are the reason we made this per alias instead of a global switch. The mssql-python path ignores driver, dsn, host_is_server, and unicode_results. There's no ODBC Driver 17 fallback. It validates extra_params against an allowlist and rejects pyodbc-only keywords such as ColumnEncryption, APP, and Connect Timeout, so use the connection_timeout option instead of the last one. It also doesn't enable MARS, which means QuerySet.iterator() reads the full result into memory before yielding rows so a nested query can reuse the connection. On a large queryset, that memory is real. Budget for it. Stay on pyodbc if you depend on a named DSN, FreeTDS, MARS, Always Encrypted through ColumnEncryption, or an ODBC driver version you manage yourself. We cleaned up the version matrix This is something we've wanted to get to for a while. mssql-django 2.0 supports Python 3.10 through 3.14, Django 5.2 through 6.1, and SQL Server 2017 through 2025, plus Azure SQL Database, Azure SQL Managed Instance, and SQL database in Microsoft Fabric. Django 6.0 and 6.1 need Python 3.12 or later. Python 3.8 and 3.9 and Django 3.2 through 5.1 are no longer supported. The compatibility code is still in the tree, so nothing breaks the moment you upgrade, but those combinations aren't tested or listed. Fixes MARS settings are honored. If you set MARS_Connection=no in extra_params, the backend used to overwrite it with the Windows default and the connection failed. That's the bug frederiksoftware reported when connecting an on-premises Django app to a Microsoft Fabric Warehouse. The explicit value now wins, case-insensitively, so those connections work. To be clear about scope: this fixes the connection, it doesn't add full Warehouse support for migrations or other SQL Server features. Bracket wildcards are escaped in F() expression lookups. A pattern lookup comparing two fields, such as filter(name__contains=F("code")), didn't escape the SQL Server [ wildcard, so bracket characters in your data were treated as wildcard syntax and matched the wrong rows. Thanks to @Khan3K for the fix. Quotes are escaped in inspectdb schema names. inspectdb --schema produced malformed T-SQL for a schema name containing a single quote. An empty HOST connects to localhost on the mssql-python path. Omitting HOST in Django settings leaves it as an empty string, which mssql-python rejected. It now resolves to localhost, matching the pyodbc behavior for local instances. pytz is gone Time zone handling moved to the standard library zoneinfo module, with the tzdata package supplying the IANA database where the operating system doesn't ship one: Windows, and minimal container images. This fixes offsets for zones with negative daylight saving offsets, and it drops a dependency. Before you upgrade mssql-python is a required dependency in 2.0 even when every alias uses pyodbc. That means mssql-django 2.0 installs only on platforms that have a compatible mssql-python distribution: Windows x64, Windows ARM64 with Python 3.11 and later, macOS 15 and later on Intel or Apple silicon, and Linux x64 or ARM64 with glibc 2.28 or later or musl 1.2 or later. SUSE Linux on ARM64 isn't supported. If you're outside that list, stay on 1.8.0. Upgrade now pip install --upgrade mssql-django Release notes Documentation Report an issue Thanks to @Khan3K and @frederiksoftware for the contributions in this release.

[In preview] Public Preview: Mdsv4 and Msv4 Series Virtual Machines for SAP

Fri, 18 Sep 2026 17:29:29 +0000

The Mdsv4 and Msv4 Series are memory-optimized virtual machine series built on 6th Generation Intel® Xeon® Scalable processors and enhanced with advanced security capabilities and the latest Azure Boost technologies. Designed for demanding memory-intensiv

[Launched] Generally Available: Enable and disable controls for Microsoft Foundry agents in Agent 365

Fri, 18 Sep 2026 17:24:02 +0000

Microsoft Foundry now exposes enable and disable actions for Foundry agent objects within the Agent 365 governance surface in Microsoft Admin Center, generally available. Administrators can control whether a Foundry agent is available for use across their

[In preview] Public Preview: Network egress controls for hosted agents in Microsoft Foundry

Fri, 18 Sep 2026 17:23:21 +0000

In public preview, Microsoft Foundry now lets customers govern the outbound connections a hosted agent can make. Customers author ordered rules matched on destination host, including FQDN with wildcards such as *.contoso.com, with actions to allow, deny,

[Launched] Generally Available: Publishing Microsoft Foundry agents to Microsoft 365 Copilot and Teams

Fri, 18 Sep 2026 17:21:06 +0000

Publishing Microsoft Foundry agents to Microsoft 365 Copilot and Teams is now generally available. An agent only delivers value once it reaches the people who need it, and Foundry developers previously had no native path to make their agents operational a

[Launched] Generally Available: Logical replication slot sync status metric for Azure PostgreSQL Flexible Server

Fri, 18 Sep 2026 16:44:11 +0000

You can now monitor the synchronization status of your logical replication slots in Azure Database for PostgreSQL – Flexible Server using the new logical_replication_slot_sync_status metric. This Azure Monitor metric shows whether each logical replication

Land Your Offer - Anatomy of Revenue Generating Partner Offer - Part 1 - Copilot in 30

Fri, 18 Sep 2026 16:15:11 +0000

Copilot in 30: A Ready-Made Marketplace Offer to Grow Your SMB Practice Thirty days. Twenty-five users. One repeatable offer that turns AI curiosity into a long-term customer relationship. Small and medium businesses know AI matters. What they lack is a trusted guide and a low-risk way to start. Copilot in 30 gives you both: a $0, 25-user, 30-day Microsoft 365 Copilot Business trial from Microsoft, wrapped in a structured journey that only a partner can deliver. Package it as a Microsoft Marketplace offer and you have a scalable on-ramp to every SMB customer in your base — and to the managed services that follow. Start Here: Why Publishing on Microsoft Marketplace Matters Microsoft Marketplace is Microsoft's partner-focused business platform, designed to help you reach more customers and simplify how you sell. A published offer gives your practice a permanent, discoverable storefront in the place customers already look for Copilot help. More importantly, an offer turns your expertise into something repeatable . Instead of scoping every engagement from scratch, you define the journey once — activities, timeline, deliverables — and run it across dozens of customers. Professional service and managed service offer types are available in Partner Center, so the same offer can carry both the 30-day journey and what comes after it. The SMB Opportunity Hiding in Plain Sight SMB customer segment is still early in their AI journey. These are organisations with 300 or fewer users on Microsoft 365 Business Basic, Standard or Premium — typically without an in-house AI team. That combination is exactly where partners win: high demand, limited internal capacity, and a customer base large enough that a well-designed, repeatable offer scales far beyond what bespoke projects can. Why Copilot Is the Right First AI Step for SMBs Microsoft 365 Copilot Business is the cost-effective Copilot add-on built for SMB customers, delivering the same capabilities as Microsoft 365 Copilot inside the apps their people already use — Outlook, Teams, Word, Excel and PowerPoint. No platform overhaul, minimal training, immediate relevance. Copilot is also the on-ramp. Once a team works confidently with Copilot, the natural next steps are agents, automated workflows and Copilot Cowork — each one deepening the customer's dependence on the partner who guided them there. Meet Copilot in 30: 25 Users, 30 Days, $0 Copilot in 30 is a limited-time, CSP partner-led Microsoft 365 Copilot Business trial for SMB customers with fewer than 300 employees. The essentials: What the customer gets: 25 Microsoft 365 Copilot Business seats for 30 days at $0, transacted through CSP New Commerce (Product ID CFQ7TTC0MM8R · SKU 006Z) Who qualifies: Customers on Microsoft 365 Business Basic, Standard or Premium with no paid Microsoft 365 Copilot today — one trial per customer How long it runs: Available to transact until 31 December 2026 What happens at Day 30: The trial auto-converts to a paid subscription unless renewal settings are changed, with a 7-day cancellation window What Microsoft provides: A launch kit, campaign materials, setup guidance, the Copilot Success Planner and conversion guidance Microsoft supplies the licences and the assets. The offer — and the customer relationship — is yours. Your Role: The Guide Who Turns a Trial Into a Habit A trial alone rarely changes behaviour. A guided trial does. Your job across the 30 days is to make sure 25 people experience real value in real work, and that the sponsor can see it. Before Day 0 — pick the right customers, become "Customer Zero" by using Copilot in your own business, secure a named sponsor and Copilot admin, and build a 30-day success plan with agreed measures. Day 0 — transact the trial, set the paid renewal quantity and term, complete admin setup, assign all 25 licences and run the kick-off with starter prompts. Days 1–28 — lead a weekly scenario (Outlook, Teams, Apps, Agents), review Copilot Analytics, re-engage low-activity users and capture proof points in the customer's own words. Days 29–30 — run the outcome and ROI review, confirm the paid offer and open the expansion and consumption conversation. Every touchpoint is partner expertise the customer cannot get from a licence alone — and every one moves the decision at Day 30 from "should we?" to "how much more?" Inside the Offer: Activities, Timeline and Deliverables Below is the full activity plan behind the offer, ready to drop into your own offer description or statement of work. ID Stage Activity Trial day (of 30) Key deliverables — Pre-req Customer eligibility (Copilot Business trial) Before Day 0 Active M365 Business base licence; no paid M365 Copilot; one $0 trial per customer; CSP New Commerce transactable; offer open to 31 Dec 2026 I1 Identify Build the prioritised target list Pre-trial Tier A/B target list from ASPX and Cloud Ascent; 50–300 eligible seats I2 Identify Confirm eligibility and trial fit Pre-trial Eligibility check: M365 Business base licence, no paid Copilot, one trial I3 Identify Launch the acquisition campaign Pre-trial Campaign email sent; briefing delivered; responses triaged into pipeline I4 Identify Be Customer Zero: complete microskilling Pre-trial Microskilling complete; internal Copilot experience; team briefed P1 Plan Confirm sponsor and success measures Pre-trial Named sponsor and admin; 25 trial users; agreed success measures P2 Plan Build the 30-day success plan Pre-trial Personalised Success Planner output; weekly scenarios; admin and user views P3 Plan Confirm technical and compliance readiness Pre-trial Minimum requirements verified; data and compliance review; blocker log A1 Activate Transact the trial in CSP New Commerce Day 0 25-seat, 30-day, $0 trial ordered (CFQ7TTC0MM8R · SKU 006Z) A2 Activate Configure the paid renewal settings Day 0 Renewal quantity, term and billing set; Cowork usage-based billing if in scope A3 Activate Complete admin setup and assign licences Day 0 Recommended settings on; 25 licences assigned (starts the clock) A4 Activate Run the kick-off and share starter prompts Day 0 Kick-off email; starter prompts; four-week prompt series scheduled X1 Experience Week 1 · Outlook — catch up and communicate Days 1–7 Week 1 prompts landed; first-week activation rate reviewed X2 Experience Week 2 · Teams — meetings that run themselves Days 8–14 Copilot Analytics checkpoint; recaps adopted; low-activity users re-engaged X3 Experience Week 3 · Apps — create in minutes Days 15–21 App scenarios and proof points; week 3 training gate before day 30 X4 Experience Week 4 · Agents — unlock the next level Days 22–28 Role-built agents trialled; 30-day usage trends from the admin centre C1 Convert Outcome review, paid offer and expansion plan Days 29–30 ROI review; 50-seat offer confirmed in 7 days; wave 2 plan; consumption conversation opened Land Your Offer: What One Customer Is Worth The table below is the revenue anatomy of one Copilot in 30 engagement — and it shows that the money is not in the trial, but in what the trial sets up. Item Value Detail Offer duration 30 days Trial clock runs Days 1–30; identify, plan and Day 0 setup precede it Trial offer 25 seats M365 Copilot Business · 30 days · $0 · one per customer · to 31 Dec 2026 CSP incentive — 25 seats (K) $0.32K 5.0% direct bill (2.5% M365 CSP Core + 2.5% Strategic Product Accelerator Tier 1) on 25 M365 Copilot Business seats x $21/mo† ≈ $6.3K/yr; indirect reseller 2.5% ≈ $0.16K Conversion target 50 seats Lead with 50 paid seats at conversion; sets up the wave 2 expansion plan CSP incentive — 50 seats (K) $0.63K 5.0% direct bill (Core + SPA Tier 1) on 50 M365 Copilot Business seats x $21/mo† ≈ $12.6K/yr; indirect reseller 2.5% ≈ $0.32K Frontier Accelerate deployment funding (K) $2.5K Microsoft Commercial Incentives funding for the Copilot deployment engagement when the conversion lands with 50 paid seats†; funds the deployment and adoption work that leads into managed services † Illustrative estimates from the offer plan. Confirm current incentive rates, funding and eligibility in Partner Center. Three streams stack on top of each other: CSP incentive — earned on every paid Copilot Business seat from the moment the trial converts, and growing again when the customer expands from 25 to 50 seats. Frontier Accelerate deployment funding — $2,500 available when you lead the conversion with 50 paid seats, paying for the deployment work that makes the expansion stick. Managed services — the recurring engagement described in Day 31 and Beyond , which is where the largest and most durable share of revenue lives. Now multiply. Everything above is the anatomy of a single customer. Landing the offer means running it across every eligible customer in your base — and you don't need to guess who they are. Partner Center's growth insights reporting, available through the AI Business Solutions & Security Insights (ASPX) dashboard , gives you account-level Copilot eligibility, seat whitespace, free Copilot Chat usage and adoption signals for the customers you already manage. To turn that export into a ranked target list, my colleague Brian O'Shea has built a Copilot for 30 Power BI dashboard that sits over your ASPX data and scores each customer on a 0–100 priority scale from eligible seats, whitespace, free-to-paid potential and opportunity signals — so your first cohort is the ten customers most likely to convert, not the first ten who reply. How the Offer Fits Together: From Trial Inputs to Proof of Value The offer runs left to right in three layers: Trial inputs — 25 users, 30 days, $0 CSP trial SKU; an SMB with 50–300 eligible Microsoft 365 seats; no paid Copilot today; a Business Basic, Standard or Premium base; one trial per customer to 31 Dec 2026; a named sponsor and Copilot admin; auto-conversion to paid unless changed. Five stages — Identify (I1–I4), Plan (P1–P3), Activate (A1–A4), Experience (X1–X4) and Convert (C1, T1, T2, W2). Each stage produces a concrete output the sponsor can see. Proof of value — a prioritised list and campaign responses; agreed use cases and success measures; a provisioned trial with 25 licences assigned; weekly usage from the Microsoft 365 admin centre; adoption proof points in the customer's words; paid conversion confirmed in Partner Center — and a named wave 2 expansion beyond the first 25. The highlighted activities — admin setup (A3), Week 4 agents (X4), 25→50 paid seats (T1), Frontier Accelerate funding (T2) and the wave 2 expansion plan (W2) — are where the engagement stops being a project and starts becoming an ongoing relationship: managed services, agent build-out, Copilot Studio and Copilot Cowork follow-on once the trial converts. Day 31 and Beyond: Managed Services That Keep Delivering The end of the trial is the start of the real engagement. Package these as standing services in your offer: Copilot adoption management — monthly Copilot Analytics business reviews, prompt and scenario refreshes, champion programme and onboarding for each new wave of users Licence and expansion management — take the customer from 25 to 50 paid seats and on to wave 2, aligning renewals, terms and billing as the footprint grows Agent build-out — design, build and maintain role-based agents with Copilot Studio for sales, service, finance and operations scenarios surfaced in Week 4 Copilot Cowork enablement and governance — introduce consumption-based Cowork scenarios, set budgets and cost controls, and report on usage each month Security, compliance and readiness — keep data protection, permissions and governance in step with expanding AI use, including a path to Microsoft 365 Business Premium Quarterly value reviews — refresh success measures, capture new proof points and agree the next expansion plan with the sponsor Each of these is a recurring, outcome-based service rather than a one-off project — and each keeps you positioned as the customer's AI partner as their needs grow. Ready to Build Your Copilot in 30 Offer? Download the Copilot in 30 launch kit and Microsoft 365 Copilot Partner FAQ from the Microsoft AI Cloud Partner Program. Be Customer Zero — run Copilot and the microskilling series inside your own business first. Publish your offer in Partner Center as a professional service (the 30-day journey) with a managed service follow-on (Day 31 and beyond). Pick your first cohort — customers with 50–300 seats on a Microsoft 365 Business plan and no paid Copilot today. Transact your first trial through CSP New Commerce (Product ID CFQ7TTC0MM8R · SKU 006Z) and set the paid renewal on Day 0. Book the Day 30 review before Day 1 — so the conversion and expansion conversation is already on the calendar. The window closes on 31 December 2026. The customers are already in your base. Publish the offer and start the clock. Resources From AI curiosity to Copilot adoption in 30 days — Microsoft Partner Blog Copilot in 30 Launch Kit — partner GTM playbook, customer trial guide, invitation and weekly prompt emails, admin setup guidance Build Your 30-Day Copilot Success Plan Copilot Success Planner Walkthrough video Partner Skilling Hub | Microskilling for Copilot in 30 Power BI Dashboard that integrates with your ASPXi Partner Data · By Brian O'Shea Create compelling customer business cases

[Launched] Generally Available: New and improved troubleshooting guides for Azure Database for PostgreSQL

Fri, 18 Sep 2026 15:51:06 +0000

Updated troubleshooting guidance is now available for Azure Database for PostgreSQL flexible server. You can use the expanded documentation to diagnose high CPU, memory, IOPS, temporary file usage, and autovacuum issues, helping you identify root causes a

[Launched] Generally Available: PG18 support for Azure Database for PostgreSQL elastic clusters

Fri, 18 Sep 2026 15:49:46 +0000

Azure Database for PostgreSQL elastic clusters now support PostgreSQL 18, bringing the latest PostgreSQL capabilities to distributed, cloud-scale workloads. You can build new applications or modernize existing ones with the performance, reliability, and d

Azure Weekly Update - 18th September 2026

Fri, 18 Sep 2026 15:08:36 +0000

Really quick update! Charity event URL at https://give.curechildhoodcancer.org/fundraiser/7465401 🔎 Looking for content on a particular topic? Search the channel. If I have something it will be there! 🤔 Due to the channel growth and number of people wanting help I no longer can answer or even read questions and they will just stay in the moderation queue never to be seen so please post questions to other sites like Reddit, Microsoft Community Hub etc. ▬▬▬▬▬▬ C H A P T E R S ⏰ ▬▬▬▬▬▬ 00:00 - Introduction 00:20 - AKS Azure Linux with OS Guard retirement 01:09 - Azure Red Hat OpenShift hosted control planes 02:12 - Azure App Gateway HTTP/3 over QUIC 02:35 - AVNM high-scale mesh 03:16 - Agentless SMB storage migration 03:52 - PostgreSQL skills and MCP 04:28 - Azure SQL DB logical server soft delete 04:57 - AVD new endpoints for the Windows App 05:22 - Azure Payments HSM v2 05:45 - Close ▬▬▬▬▬▬ Want to learn more? 🚀 ▬▬▬▬▬▬ 📖 Recommended Learning Path for Azure 🔗 https://learn.onboardtoazure.com 🥇 Certification Content Repository 🔗 https://github.com/johnthebrit/CertificationMaterials 📅 Weekly Azure Update 🔗 https://youtube.com/playlist?list=PLlVtbbG169nEv7jSfOVmQGRp9wAoAM0Ks ☁ Azure Master Class 🔗 https://youtube.com/playlist?list=PLlVtbbG169nGccbp8VSpAozu3w9xSQJoY ⚙ DevOps Master Class 🔗 https://youtube.com/playlist?list=PLlVtbbG169nFr8RzQ4GIxUEznpNR53ERq 💻 PowerShell Master Class 🔗 https://youtube.com/playlist?list=PLlVtbbG169nFq_hR7FcMYg32xsSAObuq8 🎓 Certification Cram Videos 🔗 https://youtube.com/playlist?list=PLlVtbbG169nHz2qfLvPsAz9CnnXofhmcA 🧠 Mentoring Content 🔗 https://youtube.com/playlist?list=PLlVtbbG169nGHxNkSWB0PjzZHwZ0BkXZZ ❔ Questions? Maybe I answered it in my FAQ 🔗 https://savilltech.com/faq 👕 Cure Childhood Cancer Charity T-Shirt Channel Store 🔗 https://johns-t-shirts-store.creator-spring.com/ 👂 Enable the subtitles and from there you can translate to your native language via the auto-translate feature in settings! https://youtu.be/v5b53-PgEmI for a demo of using this feature. SUBSCRIBE ✅ https://www.youtube.com/channel/UCpIn7ox7j7bH_OFj7tYouOQ?sub_confirmation=1 #microsoft #azure #johnsavillstechnicaltraining #cloud

New in Microsoft Marketplace: Offers published August 12-13, 2026

Fri, 18 Sep 2026 13:00:00 +0000

Learn about 224 new offers that went live in Microsoft Marketplace, a single destination to find, try, and buy cloud solutions, AI apps, and agents to meet your business needs. Get it now in our marketplace AI Diagnostic Partner : AI Diagnostic Partner from AI Cloud Agency Ltd. is an AI platform and managed service that helps companies assess their current state, prepare an AI transformation strategy, and estimate the potential business value of AI solutions. AirMettle Select : AirMettle Select from AirMettle Inc. lets you run standard SQL against objects in your Azure Blob Storage — no ingestion, no ETL pipelines, no database or Spark cluster to stand up, and no copies of your data. Simply point AirMettle Select at a blob and get back the rows and columns you asked for, streamed over HTTPS as they are produced . ArcGIS System : This offer from Brazil-based distributor Imagem Geosistemas provides ArcGIS, a platform developed by Esri for spatial mapping and analysis. With ArcGIS, you can identify hidden opportunities, understand territorial relationships, and strengthen decision-making. This offer is available only in Portuguese . AuraQuantic Starter Plan 2026 : This offer from AuraQuantic lets you automate business processes and easily create powerful apps enhanced with AI capabilities. The Starter Plan covers 20 users as well as support and training courses for one person . BAOS : Built for banks and financial institutions, BAOS from Creodata Solutions Limited turns account opening from a branch-and-paper process into a fully digital, auditable workflow. Set up business, personal, group, and joint accounts deployed and operated inside your own Microsoft Azure subscription . Billing as a Service for EU : This offer from Kitameraki Limited provides a software-as-a-service subscription for the EMEA version of Billing as a Service for EU. It's a native quotation, sales order, and invoicing service for use with Microsoft Teams, and it's designed for organizations that require their data to remain within the European Union to ensure compliance with GDPR . BorakDesk : BorakDesk is a Microsoft-native marketing automation platform built on Azure, giving business-to-business growth teams a single system for the full customer lifecycle. Using Paro AI, it generates a complete marketing campaign from a single prompt in less than two minutes . Captivate : Captivate from Turn.CEO pulls your revenue data from Stripe, QuickBooks, Xero, and Square; your CRM pipeline from HubSpot, Salesforce, Pipedrive, and GoHighLevel; your social media analytics from LinkedIn, Facebook, Instagram, TikTok, and YouTube; your website traffic from Google Analytics; and your reputation data from Google Reviews and Yelp, then presents it all in one clean dashboard . Codex KPI Wall : Codex KPI Wall from Nexus Codex is a responsive KPI card grid made for Microsoft Power BI. One card per metric — each with its own value, target, and variance pill — is laid out in a grid that fits the space you give it. One visual replaces a page of individually placed cards . Concierto Migrate : Concierto Migrate is an AI-powered cloud migration platform that replaces fragmented tooling, manual wave planning, and high-risk cutovers with a single automated factory that delivers the complete migration lifecycle — assess, plan, execute, validate, and cutover — in one unified platform. Concierto Modernize : Concierto Modernize is an AI-powered enterprise application and database modernization platform that automates the complete modernization lifecycle, from assessment and recommendation to transformation, validation, and deployment . Cybereinforce Threat Enforcement SaaS (Corporate Plan) : Microsoft Defender threat indicators are highly effective in protecting users within Microsoft Edge, but organizations that rely on other web browsers may require additional enforcement mechanisms. Cybereinforce bridges this gap by automatically ingesting Microsoft Defender threat indicators and enforcing them across other enterprise browsers . Cybereinforce Threat Enforcement SaaS (Enterprise Plan) : Cybereinforce automatically ingests Microsoft Defender threat indicators and enforces them across Chrome, Firefox, Safari, and other enterprise browsers. The Enterprise plan adds compliance-grade retention and premium investigation support as well as a custom-branded blocked page . Cybereinforce Threat Enforcement SaaS (SME Plan) : Cybereinforce automatically ingests Microsoft Defender threat indicators and enforces them across Chrome, Firefox, Safari, and other enterprise browsers. The SME plan adds security telemetry and SOC-ready visibility . Datellers Process Mining Visual : Datellers Private Limited's custom visual for Microsoft Power BI lets you turn event data into interactive process maps. Instead of relying on assumptions about how a process should work, Process Mining lets you see exactly how it does work, built directly from your case ID, activity, and timestamp data, helping you uncover inefficiencies, hidden variants, and improvement opportunities hiding in plain sight . DeepInspect Gateway : DeepInspect is an AI governance and security control plane that sits between your users, agents, or AI applications and the large language models or model APIs they consume. Every prompt, response, and tool call is inspected, policy-checked, and recorded in real time . Enable Rebate Management : Enable is a business-to-business rebate management platform that makes it easy to manage complex programs. Enable streamlines the process while showing you the influence and impact that strategic rebate programs have on your company's growth, returns, and opportunities . FogLifter Transactable : FogLifter from Virtual Service Operations LLC transforms how you manage enterprise data by validating, normalizing, and reconciling inputs from Apptio, ServiceNow, OEM tools, and more, ensuring your decisions are based on facts, not guesswork . GiveLife365 : GiveLife365 from Alphavima Technologies Inc. is a customer relationship management system built on Microsoft Dynamics 365. Designed for nonprofits, GiveLife365 improves donor retention, cuts administrative time, and reports impact to boards, donors, and grant funders . Govern360 : Govern360 from Aivons is a policy decision and evidence plane for enterprise AI. It discovers the AI in your organization — users, models, agents, non-human identities, and MCP tool access — then compiles governance intent into native enforcement configuration for platforms you already operate . Hyppos AI: Predictive Model Generation : Hyppos AI: Predictive Model Generation from Hyperion Systems Engineering is a containerized, end-to-end regression modeling engine deployed directly within an Azure subscription. It automates data preprocessing, time-series cross-validation, and hyperparameter optimization across multiple learners, generating a professional HTML report and exportable model assets . Lens by Tealdroid : Lens by Tealdroid helps SharePoint and Microsoft 365 administrators see who has access to what, how content and storage are being used, and where governance risk is building. It connects through Microsoft Graph and SharePoint APIs, then turns tenant data into clear, prioritized insights you can act on . Lucid Ops in a Box : Lucid Ops in a Box from Lucid Labs Pty. Ltd. is a multi-tenant Model Context Protocol (MCP) server that runs operations for your organization. Native to Microsoft 365, the platform covers the everyday operational surface your team runs every day: mail, calendar, Microsoft Teams, SharePoint, OneDrive, Microsoft Planner, Microsoft Excel, and unified search . Memori : Memori from Memori Labs is an agent-native memory infrastructure designed to support enterprises in running autonomous AI agents at scale. It addresses the challenges of inflated inference costs and degraded accuracy caused by passing full conversation and execution traces back to large language models during multi-step workflows . MeshInsights : MeshInsights from Mesh Systems is a guided engagement that helps connected-product companies build and deploy AI agents that turn machine data into reliable operational decisions and action at scale. MeshInsights connects to existing platforms and operational systems, automates repeatable expert reasoning, and enables agents to trigger the appropriate next step through existing workflows . PoliEze for Application Control : PoliEze from Gritellect Pty. Ltd. PoliEze helps organizations operationalize app control by making trusted software execution practical, visible, and continuously enforceable across managed Windows endpoints. Security and endpoint teams gain the intelligence needed to understand application activity, assess policy impact, resolve blockers, and progress from audit to enforcement with confidence . Risk Heatmap Premium : This custom visual from Zedry Carlos Araya Masis builds on Microsoft Power BI to give you a sleek way to visualize impact vs. likelihood. Key features include risk movement tracking, smart clustering, and full customization . SCB Global Connect: Small Business Phone : Turn Microsoft Teams into your small business phone system in just days with SCB Global Connect, which simplifies the migration process and offers a wide range of services, including number porting, calling configuration, and user onboarding . SMARTFENSE : The SMARTFENSE cybersecurity platform combines awareness and assessment tools with phishing simulations, false positive detection, regulatory and policy management, and reports with data correlation and AI automation. This offer is available only in Spanish . Sounds Like Me: Exec AI Twin : This executive AI twin from Courageous Success Ltd. adds a governed leadership thinking layer to Microsoft Copilot so senior leaders can work with AI that reflects their voice, applies their frameworks, and holds their standards under pressure . UnifiedOne Platform : The UnifiedOne platform integrates with Microsoft Entra ID, Microsoft Defender, and Microsoft Intune to analyze identity risks, ingest and correlate threat incidents, and evaluate device security posture across multiple tenants . Unlimitech PPM Platform for Azure : Unlimitech PPM Platform helps organizations deploy and operate Microsoft Project Server Subscription Edition on Microsoft Azure using validated enterprise architectures and managed services. The solution is designed for IT departments, government agencies, and enterprise organizations that require full control of their project portfolio management environment while maintaining ownership of their Azure resources . Urbanise eProcure : Urbanise eProcure from Urbanise Technology is a source-to-pay and e-tendering platform designed for the public sector. Urbanise eProcure covers the full procurement lifecycle, from demand planning, sourcing, and tender evaluation through contract management, purchasing, invoicing, and payment tracking . Veritas Digitisation Portal : The Veritas Digitisation Portal is a platform designed to streamline and simplify the process of digitizing documents and records. This solution is ideal for businesses and organizations looking to transition from paper-based processes to a more efficient, digital-first approach . voyage code-4 AI Foundry : MongoDB's voyage-code-4 is a next-generation code-embedding model for coding agents. Enabled by Matryoshka learning and quantization-aware training, voyage-code-4 supports embeddings in 2048, 1024, 512, and 256 dimensions, with multiple quantization options . WeTransact AI GTM : Co-sell stalls when there's nothing to co-sell. WeTransact AI GTM runs agentic direct outreach to your target accounts, books qualified opportunities, and routes each one to the right Microsoft account executive, turning partner-sourced demand into co-sell pipeline . Wi-Fi Hotspot Management Portal : Konecta Wi-Fi Portal is a complete Wi-Fi and hotspot management platform that lets you run, secure, and monetize guest and public internet access from one dashboard. Whether you manage a single venue or hundreds of sites, you control who connects, how long they stay online, how much bandwidth they use, and what you earn from it . Zoviz Enterprise Content Creation : Zoviz Enterprise brings enterprise content creation to the Zoviz AI branding platform. Give your teams one governed workspace to generate images, video, and campaign assets with the leading AI models, under the controls IT expects . Easily deploy virtual machine images MySQL on Debian 12 1Panel 2FAuth Actual Budget Admidio Altair GraphQL Client Apache Allura Apache Pulsar Apachelggy Asciinema Server AWStats Chhoto URL on Ubuntu 26.04 Colyseus copyparty Self-Hosted File Server on Ubuntu 26.04 Dagu dcm4chee-arc-light DFIR-IRIS DKAN Data Portal Echo on Ubuntu 26.04 Erugo Firefly FreeScout Fusion RSS Reader GPT Researcher grpcUI Ibexa OSS Incus on Ubuntu 26.04 Komari Lucee Mindustry Server MockServer Music Assistant netboot.xyz Netflix Eureka Server Netshot Notesnook Sync Server ONLYOFFICE Docs openGemini OpenJDK OpenObserve pgagroal phpMyFAQ Pingvin Share ProjeQtOr Prowler Puter QGIS Server SCM-Manager Shlink sish Stalwart temBoard TiddlyWiki Trek uTask Vearch Wallabag WatchYourLAN Network Scanner Wavelog Amateur Radio Logbook webtrees Yggdrasil Cockpit on Rocky Linux 9 Enterprise for Windows 11 Enterprise 25H2 (x64 Gen 2) Enterprise for Windows Server 2019 Datacenter (x64 Gen 2) Enterprise for Windows Server 2019 Datacenter Core (x64 Gen 2) Enterprise for Windows Server 2022 Datacenter (x64 Gen 2) Enterprise for Windows Server 2022 Datacenter Core (x64 Gen 2) Enterprise for Windows Server 2025 Datacenter Core (x64 Gen 2) Graylog on Rocky Linux 9 Jenkins LTS on Rocky Linux 9 MariaDB 11 on Rocky Linux 9 OpenSearch on Rocky Linux 9 Prometheus + Alertmanager on Rocky Linux 9 Weaviate Vector DB on Rocky Linux 9 Moodle, Supported by BMM Chariot MQTT Server and IoT Bridge for Snowflake IoT Bridge for Snowflake on Chariot Docling, Supported and Secured by the Hossted Platform Dokploy, Supported and Secured by the Hossted Platform Keycloak: Hardened Identity and Access Management NetBox: Hardened DCIM and IPAM Source of Truth ZAP Web Security Scanner: Hardened DAST for Web Apps, APIs Rocky Linux 10 from OpenLogic by Perforce Centos 10 CentOS Stream 10 DISA STIG Hardened CentOS Stream 10 Anonify: Redaction and Anonymization Tool Go further with workshops, proofs of concept, and implementations ADAM on Microsoft Fabric : Brillio will implement ADAM, an agentic activation layer that natively integrates with the unified data foundation of Microsoft Fabric. ADAM employs a suite of configurable, enterprise-grade agents to automate and optimize data operations, including data quality, engineering, observability, governance, and insight generation . Agent 365 Foundation by Experts Inside : Experts Inside AG HQ will deliver a structured setup package to activate Microsoft Agent 365 within your Microsoft 365 tenant and establish enterprise-grade observability and governance for your entire AI agent landscape . Agentic Client Servicing : This professional services engagement from Zensar Technologies will help capital markets firms get started with or extend their use of Microsoft Power Apps by modernizing client servicing operations through low-code applications, workflow automation, case management, and intelligent relationship manager workflows . Agentic Corporate Actions Processing : This professional services engagement from Zensar Technologies will help financial institutions get started with or extend their use of Microsoft Power Apps by modernizing and automating corporate actions operations through low-code applications, workflow automation, and AI-enabled decision support . AI Agents, Copilot Studio Readiness Assessment, and Agent POC : In this proof of concept, CloudMoyo will assess your organization's readiness for AI agents and Microsoft Copilot adoption, then identify high-value AI agent use cases and build a working agent using Copilot Studio or Microsoft Foundry based on fit . AI Readiness Assessment : This professional service from Zensar Technologies will help organizations get started with Microsoft Power Apps or extend existing Power Apps investments by assessing business, process, data, governance, and technology readiness for low-code application development and AI-powered automation . AI-Driven Customer Onboarding : This professional services engagement from Zensar Technologies will help retail banks get started with or extend their use of Microsoft Power Apps by modernizing customer onboarding through low-code applications, workflow automation, case management, and customer engagement capabilities . AI-Powered Regulatory Compliance : This professional services engagement from Zensar Technologies will help retail banks get started with or extend their use of Microsoft Power Apps by creating low-code financial wellness, customer engagement, and relationship management solutions that transform transaction data into personalized insights, actionable recommendations, and meaningful customer interactions . Analytics for Enterprise : Wragby Business Solutions & Technologies Limited will implement Analytics for Enterprise, one governed data platform built on Microsoft Fabric. Analytics for Enterprise delivers an end-to-end pipeline from ingestion to business-ready reporting, and it scales from one business unit to a full enterprise data estate . Automated Claims Processing : This professional services engagement from Zensar Technologies will help property and casualty insurers get started with or extend their use of Microsoft Power Apps by modernizing claims operations through low-code applications, workflow automation, claims case management, and intelligent decision-support capabilities . BearingPoint Project Scorecard Implementation : This professional service from BearingPoint will enable customers to accelerate their adoption of Microsoft Copilot Studio by implementing a project scorecard agent. This will allow managers to submit project status, risks, milestones, and delivery updates through a conversational AI experience in Microsoft Teams . Claims Fraud Detection Agent Workflow : This professional services engagement from Zensar Technologies will help insurance organizations get started with or extend their use of Microsoft Power Apps by modernizing claims fraud detection, investigation management, and fraud operations through low-code applications, workflow automation, and intelligent decision-support capabilities . Coforge's Data Cosmos AI ETL Script Convertor : Coforge will implement AI ETL Script Convertor, a modernization platform designed to help enterprises transition legacy Informatica ETL workloads into modern, cloud-native data engineering pipelines on Microsoft Azure . Coforge's Data Cosmos Code Quality Agent : Coforge will help customers get started with, or extend their use of, Microsoft Azure by establishing enterprise-grade, AI-powered code quality gates across Azure-hosted applications and data engineering stacks . Copilot Cowork Enablement : Long View Systems will establish the foundation for a successful Microsoft 365 Copilot Cowork engagement through stakeholder alignment, success criteria definition, and environment access validation. Long View Systems will prepare your environment by configuring Copilot Credits, establishing spending controls, reviewing governance requirements, and creating an ROI measurement framework to evaluate business impact . Epic on Azure Migration : Innova Solutions will migrate your healthcare organization's Epic workloads to Microsoft Azure. Innova's experts will assess, design, migrate, validate, and transition the workloads through a phased approach that reduces risk, protects clinical continuity, and supports operational readiness . From Ideas to Impact: Accelerating Frontier Transformation : NTT DATA will help your organization accelerate your frontier transformation journey using Microsoft’s full AI stack. This will entail getting started with Microsoft Copilot Studio, scaling agent capabilities, embedding them into business processes, driving sustained usage, strengthening governance through the Microsoft Agent 365 control plane, and delivering measurable value . FrontierIQ : IBM Consulting will help your organization move from disconnected AI pilots and fragmented workflow transformation efforts to governed, measurable operating-model change. IBM will work with your team to start with one high-friction workflow, establish process truth, design the future operating model, launch a governed pilot, prove the outcome, and scale the pattern. GoDaddy and Microsoft Cloud Integration Services : Unify GoDaddy domain management, DNS infrastructure, and email services with Microsoft 365 identity, cloud automation, and security ecosystems. IT Partner can deliver enterprise-grade integration services tailored to your operational and compliance requirements . KYC and AML Risk Agent Suite : This professional services engagement from Zensar Technologies will help financial institutions get started with or extend their use of Microsoft Power Apps by modernizing know-your-customer (KYC) and anti-money laundering (AML) operations through low-code applications, workflow automation, case management, and risk assessment solutions . Methods Migration Service for Azure : Move to Microsoft Azure with confidence. Methods Business and Digital Technology Limited will help your organization transition from legacy and on-premises environments to a secure, scalable, future-ready cloud platform . Methods Delivery for Azure Integration Services : Connecting systems is what turns cloud adoption into real business value. Methods Business and Digital Technology Limited will help your organization integrate applications, data, and processes across cloud and on‑premises environments, creating seamless end-to-end connectivity across enterprise systems . Methods Service for Copilot Adoption : Secure and scale Microsoft 365 Copilot with confidence. Methods Business and Digital Technology Limited will help your organization move from uncertainty to impact with a structured adoption framework that connects technical readiness with measurable business outcomes, ensuring that Copilot delivers value from the outset . Methods Implementation for Microsoft Fabric : Methods Business and Digital Technology Limited will help your organization adopt Microsoft Fabric so you can streamline data integration, management, and analytics within a single, scalable environment . Methods Proof of Concept for Microsoft Fabric : Methods Business and Digital Technology Limited will help your organization rapidly design, implement, and evaluate a tailored Microsoft Fabric environment within your existing Microsoft Azure estate. The goal is to demonstrate value, assess feasibility, and provide clear evidence for scaling to production . Methods Managed Services for Microsoft SharePoint : Cloud environments don’t stop at deployment; they need to be continuously managed, supported, and optimized. Methods Business and Digital Technology Limited will provide ongoing support and management across Azure and Microsoft 365, ensuring that your cloud platforms and end-user services remain secure, stable, and high-performing . Methods Configuration Service for Microsoft SharePoint : Effective collaboration depends on how information is structured, shared, and governed. Methods Business and Digital Technology Limited will help your organization design and implement SharePoint solutions that improve collaboration, document management, and knowledge sharing across Microsoft 365 . Methods Modern Workplace Services : A modern workplace isn’t defined by location; it’s defined by how effectively people can connect, collaborate, and get work done. This service from Methods Business and Digital Technology Limited will transform how people work, connecting collaboration, productivity, and user experience across your Microsoft 365 environment . Microsoft 365 Managed Services Implementation : Pioneer Technology will help your organization deploy, secure, and optimize Microsoft 365 so you can improve collaboration and strengthen security. To reduce the burden on internal IT, this service combines expert guidance with ongoing operational support . Microsoft Fabric Adoption, Architecture Assessment, and Foundation POC : CloudMoyo will assess your organization's data and analytics estate, map priority workloads to Microsoft Fabric services, design a target-state Fabric architecture and OneLake medallion structure, and stand up a working foundation proof of concept in your tenant to validate the recommended pattern . Microsoft Fabric Data Estate Modernization Assessment : CloudMoyo will assess your organization's data estate, identify modernization opportunities, design a consolidated Microsoft Fabric target-state architecture, and build a proof of concept that modernizes the selected domain onto Microsoft OneLake . Microsoft Fabric Proof of Value : Peruzzi Solutions will implement a limited but usable end-to-end scenario using your company's customer data so that your business and technology stakeholders can assess Microsoft Fabric's value based on practical evidence rather than on product demonstrations alone . Payment Orchestration Agent Suite : This professional services engagement from Zensar Technologies will help financial institutions get started with or extend their use of Microsoft Power Apps by modernizing payment operations through low-code applications, workflow automation, exception management, and intelligent payment-routing capabilities . Predictive AI Customer 360 : This professional services engagement from Zensar Technologies will help banks and financial institutions get started with or extend their use of Microsoft Power Apps by implementing intelligent, low-code relationship management solutions that unify customer insights, automate decision-making workflows, and empower relationship managers with actionable recommendations . Prodigy CivicDuty AI : CivicDuty AI is a monthly subscription service from Prodigy Consulting LLC that enables government agencies to continuously adopt and operationalize Microsoft AI technologies. Rather than traditional one-off consulting engagements, CivicDuty AI delivers structured, ongoing support . Real-Time Intelligence Readiness Assessment : CloudMoyo will assess your company's streaming and event data sources, identify high-value real-time intelligence use cases, design a Microsoft Fabric Real-Time Intelligence architecture, configure a proof of concept, and build an actionable alert or dashboard to prove time-to-insight . RegulatoryIQ : IBM's RegulatoryIQ offer combines IBM regulatory expertise, process intelligence, control design, and operational delivery to help organizations translate policy and regulatory obligations into measurable control execution . Secure Enterprise Knowledge Assistant Pilot : In this proof of concept, Peruzzi Solutions will turn your trusted organizational knowledge into a secure AI assistant built on Microsoft Azure. This will let your employees find internal knowledge via generative AI while maintaining appropriate security, access control, traceability, and governance . Semantic ISO 20022 Transformation : This professional services engagement from Zensar Technologies will help organizations get started with or extend their use of Microsoft Power Apps by assessing business readiness, identifying high-value use cases, and accelerating the development of low-code applications and process automation solutions . SQL to Microsoft Fabric Migration Readiness Assessment : CloudMoyo will assess your SQL Server and Azure SQL environments for migration readiness, then develop a migration plan and a dependency map. CloudMoyo will select a representative workload for validation and execute a scoped migration proof of concept into a Microsoft Fabric lakehouse or warehouse . Contact our partners Acuity Analytics Managed Services Agent 365 and AgenticOps Governed Foundation AgenticOps Managed Services AI Governance and Agent Readiness Briefing AI Production Readiness Assessment AiDAP: Agentic Migration and Modernization Platform AIR Teams: 8-Week AI Accelerator and POC AiryDocs Azure FinOps Assessment: Optimize Cloud Spend and Fund Your Next Wave of Innovation Better Email Beyryl BK Document AI: Shipping and Trade Document Automation on Azure CAP Exchange - Orchestrator CenterFuze Cisco Catalyst Center Global Manager CitiusTech AI RCM Denial Prediction COSMO Discrete Manufacturing CRM Data Security Envisioning Workshop Data4Business Date Picker Databricks and Fabric Integration Assessment Delivery Schedule-Sales Dashboard Customer and Vendor Item References for Dynamics 365 Business Central Drop Shipments and Special Orders for Dynamics 365 Business Central Landed Cost and Tariff Tracking for Dynamics 365 Business Central Multi-Location Transfers and Stock Balancing for Dynamics 365 Business Central E-Reconciliation Package Electronic Permitting Solution Electronic Reporting Archive EnCloud AI Agents Enhanced Email Scenarios Epic on Azure Assessment Gradebot Enterprise Inventory Dashboard for Microsoft Power BI IRI CoSort IRI NextForm Konfer Confidence LearningGPT for Business m+m EDI with Package Management Methods Cloud Readiness Assessment Microsoft Fabric SKU and Capacity Optimization Assessment Multi-Field Selector Nihilent Landing Zone Assessment OptimalChain: AI Inventory Optimisation & Demand Forecasting Orbit Bubble Chart ProtoGrants Grant Administration RuhBot Data Analytics Ruhbot SME On-Prem SCOUT Cloud Optimisation and Health Check for Microsoft 365 and Azure Shefware OLM to PST Converter Smart Scan SmartCX Statistico Interactive: Comprehensive Statistical Platform for Microsoft Excel Synthaize Fin SysInfo PDF Repair Tool SysInfo PST Password Remover UZM Price List Vendor Supplier Onboarding Vin2B Visium Devin This content was generated by Microsoft Azure OpenAI, then revised by human editors.

Foundry IQ with D365F&O and Fabric IQ

Fri, 18 Sep 2026 12:22:02 +0000

Business Scenario A retail organization runs multiple promotional sales events across its store network in different cities, featuring various product categories where Data is captured from third-party systems (products, stores, sales events) and D365 Finance and Operations (customer data) Customers are linked to stores based on city , and each store hosts specific sales events. To figure out the store generating highest revenue , store event driving the best outcome , majority customer footprint , the organization has implemented copilot studio agent using Fabric IQ, Ontology and ERP MCP. New Business Challenge Beyond understanding past performance, the retailer wants the system to answer: Are there procurement risks impacting promotional sales? Which cities should receive additional marketing spend? Solution Create a foundry agent using Foundry IQ including Fabric IQ, Web IQ, Web IQ as knowledge source. Foundry IQ is not the source of data . Its primary role is the reasoning, orchestration, and decision-making layer that connects insights from Fabric IQ, Work IQ, and Web IQ , sharepoint, blob, custom agents etc and generates business recommendations. It is backed by Azure AI search to get an indexed search with accurate result. A. Prerequisite: Data Sources & Relationships Overview Product, store, and sales event data are sourced from third-party systems . Customer data is sourced from the ERP (Dynamics 365 Finance & Operations) system through Fabric. How the data is connected: Customers are linked to stores based on city alignment (customer city = store location). Sales events are associated with: o The products being sold , and o The stores where the events are conducted . Country specific marketing policy documents stored in sharepoint WebIQ Setup for getting real time information from web (Web IQ is the key enabler for the supplier-news scenario. It can help with Real-time supplier news, market disruptions, geopolitical events, regulatory changes, competitor activity) Ref: https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/tools/web-iq Finance and Operations data connected toFabric Lakehouse Ref : Link your Dataverse environment to Microsoft Fabric and unlock deep insights - Power Apps | Microsoft Learn Store, event , Product data ingested to lakehouse using any of the methods as outlined in the documentation below Ref : https://learn.microsoft.com/en-us/fabric/data-engineering/load-data-lakehouse Fabric Ontology created combining the F&O customer, store, product and event data (sample screenshot below) A Microsoft Foundry project with an LLM deployment , such as gpt-4.1-mini. Authentication and permissions on your search service and project. B. Architecture Pattern C. Step by Step Configuration Goto Azure portal and add a search service (as that runs in the background of foundry IQ for an indexed search) Ref: https://learn.microsoft.com/en-us/azure/search/search-create-service-portal Goto Azure foundry portal ( https://ai.azure.com/ ) and add an agent with ERP MCP as a tool: Goto knowledge (Foundry IQ) and select the AI Search Create a knowledgebase and add the following options: Fabric IQ , Web , SharePoint. Use the knowledge base for the Retail growth Intelligence agent Working with the agent The agent can be published in the channel of choice (M365, teams, copilot studio using A2A etc). Ref: https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/publish-copilot The question "Are there procurement timeline or any other risks impacting promotional sales?" is exactly the type of cross-domain reasoning scenario where the agent combines: Fabric IQ Ontology → understands relationships between Store, Product, SaleEvent, Customer. F&O ERP MCP → retrieves operational procurement data such as PO status, Confirmed Delivery Date, Vendor performance, Inventory levels. SharePoint Policy Repository → validates country-specific marketing investment rules and campaign approval constraints. Foundry IQ/Web Intelligence (if enabled) → checks supplier news, disruptions, external market events. Sub-question Source Why Which promotional sale events are upcoming, at which stores, for which products Fabric IQ ontology The ontology gives the agent "business meaning… entity types (such as Store, Product…) and their relationships, not just raw tables" — so SaleEvent → Products → Store is the anchor. Are the promoted products actually going to be in stock in time — open POs, confirmed delivery dates, vendor lead times, on-hand/available inventory, any PO holds or approval delays D365 F&O via the ERP MCP server The dynamic ERP MCP server exposes data tools (entity CRUD via OData entities) and form tools, so the agent can read purchase order lines, confirmed receipt dates, inventory on-hand, vendor lead time — the procurement facts the ontology simply doesn't hold. Does the promotion comply with the country policy — approval lead times, spend caps, blackout periods, mandatory sign-offs SharePoint (Marketing Policy / Germany, India, USA) Policy is unstructured and country-specific; the agent must pick the folder matching the store's country and read it D. Conclusion The approach transforms disconnected operational and market information into a unified decision-support experience using the process flow as: Business Question → Understand Context → Retrieve Live ERP Data → Validate Policies → Check External Risks → Correlate Insights → Recommend Business Action It is helping business stakeholders to take proactive, AI-driven decisions ensuring the following business advantage Faster decisions: reduces manual reconciliation across multiple systems and documents. Higher-quality recommendations: connects operational facts with business context and external signals. Scalable access: makes cross-domain intelligence available through a reusable, conversational agent. Proactive risk detection identifies supply, inventory, policy, and market risks before promotions are affected

The Story of VS Code - Watch Party!

Thu, 17 Sep 2026 22:50:40 +0000

Join us for the documentary watch party for Visual Studio Code. "Erich Gamma once called VS Code an overnight success 10 years in the making. Those 10 years were pretty eventful. Before becoming one of the most widely used developer tools in the world, VS Code started with a small team building online developer tools out of Zurich, called itself Monaco, then Visual Studio Online Monaco, then Ticino (because why not?), became a desktop editor, went open source, became an ecosystem in its own right, went back to the browser, and helped establish a whole bunch of open protocols along the way. And just when it felt like the hard part was done, AI happened. This is the story of how VS Code got here, told by the people who built it and the developers who helped shape it. And now, how it’s adapting once again as AI changes what a code editor can be."

Agentic Azure Insights - October 20th

Thu, 17 Sep 2026 22:41:49 +0000

Implement advanced monitoring for Foundry Models through a gateway

Thu, 17 Sep 2026 20:32:34 +0000

Learn how to implement advanced monitoring scenarios for Foundry Models, like chargeback and auditing, through a gateway.

[In preview] Public Preview: Azure Payments HSM v2

Thu, 17 Sep 2026 18:36:44 +0000

Azure Payments HSM v2 is a highly available, single-tenant Payment HSM service for payment processing, credential issuance, PIN processing, key management, and authentication data protection. Customers retain exclusive administrative control of an isolate

[Launched] Generally Available: High-scale mesh in Azure Virtual Network Manager

Thu, 17 Sep 2026 17:40:33 +0000

High-scale mesh using connected group in Azure Virtual Network Manager is now in general availability. In available regions, customers may connect up to 3,000 virtual networks in a single mesh connectivity configuration by default and higher scale IP conn

You do not have to code after 5

Thu, 17 Sep 2026 17:13:06 +0000

Kat does not want to look at code after 5. She says that is normal, and it is not a character flaw. Kat Excellence writes at katexcellence.io Full episode: hanselminutes.com/1021/ #shorts

From guidance to action: Security fundamentals that materially reduce risk

Thu, 17 Sep 2026 17:00:00 +0000

AI has made fundamental changes to the operating environment for cybersecurity. Explore exposure management guidance on recommended controls and take action and stay ahead of cyberthreats. The post From guidance to action: Security fundamentals that materially reduce risk appeared first on Microsoft Security Blog .

Improving email security outcomes with real-world Microsoft Defender insights

Thu, 17 Sep 2026 16:00:00 +0000

The latest email security benchmarking reports show strong Microsoft Defender performance across pre-delivery and post-delivery scenarios and reveal where threats and defenses continue to evolve. The post Improving email security outcomes with real-world Microsoft Defender insights appeared first on Microsoft Security Blog .

Announcing Microsoft Desired State Configuration v3.3.0

Thu, 17 Sep 2026 14:57:07 +0000

This post announces the General Availability of Microsoft Desired State Configuration (DSC) v3.3.0, with new Windows resources, a registry adapter, server mode improvements, expression function updates, expanded what-if support, and experimental export filtering. The post Announcing Microsoft Desired State Configuration v3.3.0 appeared first on PowerShell Team .

Online Exchange Database Repair: Comparing Stellar’s Online Service and Desktop Software

Thu, 17 Sep 2026 11:32:55 +0000

An Exchange database that will not mount can leave users without access to email, contacts, and calendars. When a healthy database copy or usable backup Continue Reading 9 Min. Read

Compare AWS and Azure database services

Wed, 16 Sep 2026 22:24:06 +0000

Compare relational and non-relational database services on Azure and AWS, including document, key-value, wide-column, graph, and in-memory data stores.

Compare AWS and Azure analytics services

Wed, 16 Sep 2026 22:24:06 +0000

Compare analytics services on Azure and AWS for data integration, data lakes, data engineering, data warehouses, real-time analytics, governance, and business intelligence.

Compare AWS and Azure AI and machine learning services

Wed, 16 Sep 2026 22:24:06 +0000

Compare machine learning, generative AI, vision, speech, language, document intelligence, and AI search services on Azure and AWS.

Beyond Virtualization: Why Microsoft and Azure Local Stands Out as a leader in Two Gartner Magic Quadrants

Wed, 16 Sep 2026 22:15:02 +0000

Organizations are rethinking their infrastructure strategies. Traditional virtualization remains essential, but customers increasingly need a platform that also supports hybrid operations, edge computing, AI, and digital sovereignty. The newly released Gartner® Magic Quadrants for Server Virtualization Platforms and Distributed Hybrid Infrastructure examine these two closely connected areas. The Server Virtualization Platforms report arrives as Gartner … The post Beyond Virtualization: Why Microsoft and Azure Local Stands Out as a leader in Two Gartner Magic Quadrants appeared first on Thomas Maurer .

Compare AWS and Azure messaging services

Wed, 16 Sep 2026 21:44:16 +0000

Compare messaging service differences between Azure and AWS. Know Azure equivalents for Simple Email Service, Simple Queue Service, and messaging components.

Build Your Own AI Agent Harness in C#, the MafClaw Live Series

Wed, 16 Sep 2026 21:00:00 +0000

I am building a complete C# agent live, from a single call around an IChatClient to a production-ready, observable, governed agent, using the Microsoft Agent Framework harness in a 4-part Microsoft Reactor series. The post Build Your Own AI Agent Harness in C#, the MafClaw Live Series appeared first on .NET Blog .

Why Kat picked college over a bootcamp

Wed, 16 Sep 2026 18:42:35 +0000

Kat Excellence walked me through why she chose a CS degree over a bootcamp. Student-only internships, a broader education, and a network that reaches Big Tech. Kat writes at katexcellence.io Full episode: hanselminutes.com/1021/ #shorts

Retirement Update: SAP container images removed October 14, 2026

Wed, 16 Sep 2026 17:19:02 +0000

The containerized SAP data connector retired on September 14, 2026 and is unsupported and unmaintained. Existing TLS-compliant agents may continue sending logs through the retired HTTP Data Collector API. Container images will be removed on October 14, 20

[In preview] Public Preview: Azure SQL updates for mid-September 2026

Wed, 16 Sep 2026 17:15:10 +0000

In mid-September 2026, the following updates and enhancements were made to Azure SQL:Configure soft delete for the Azure SQL logical server. When the logical server is deleted, it goes into a soft deleted state and is self-restorable during the configured

Investing in a more reliable Microsoft Graph PowerShell experience

Wed, 16 Sep 2026 16:02:40 +0000

We’re focusing Microsoft Graph PowerShell on the platform where we can give you the most reliable, capable, and well-maintained experience: PowerShell 7.x and later. Built on modern .NET, PowerShell 7.x resolves many of the underlying assembly-loading and dependency issues that affect Windows PowerShell 5.x today. Concentrating our engineering there means faster fixes, quicker delivery of […] The post Investing in a more reliable Microsoft Graph PowerShell experience appeared first on Microsoft 365 Developer Blog .

[In preview] Public Preview: Azure Red Hat OpenShift with hosted control planes

Wed, 16 Sep 2026 14:13:08 +0000

Azure Red Hat OpenShift with hosted control planes is now in public preview. It is a new deployment option for Azure Red Hat OpenShift that runs the OpenShift control plane as a fully managed service, separate from the worker nodes that run customer appli

[In preview] Public Preview: PostgreSQL skills and MCP plugin for Azure Database for PostgreSQL

Wed, 16 Sep 2026 14:07:14 +0000

The PostgreSQL skills and MCP plugin turns supported AI coding assistants into context-aware PostgreSQL experts that can both provide guidance and act on a connected database. The bundled plugin combines expert-curated skills for PostgreSQL and Azure Data

Continuous Access Evaluation: Is it really tho?

Wed, 16 Sep 2026 06:00:00 +0000

An investigation into Outlook Mobile continuing to access Exchange Online mailbox data after Conditional Access and Continuous Access Evaluation say the session should no longer be authorised.

Cybersecurity Mittendrin - Folge 27 - Prompt Engineering vs. Context Engineering!

Wed, 16 Sep 2026 03:00:17 +0000

In diesem Video vergleichen wir Prompt Engineering und Context Engineering. Links: https://github.com/tomwechsler/Online_Workshops https://github.com/tomwechsler/Online_Workshops/blob/main/Cybersecurity_f%C3%BCr_KMU_Praxisorientierter_Einstieg/Readme.md https://github.com/tomwechsler/Cyber_and_Information_Security_Knowledge_Base #Prompt #Cybersecurity #CybersecurityMittendrin

Network secure ingress pattern implementation with Azure Front Door Premium tier

Tue, 15 Sep 2026 22:50:21 +0000

The pattern implementation for network secure ingress illustrates global routing, health-based origin failover, and attack mitigation at the edge.

Automate API Management configuration deployments by using APIOps CLI

Tue, 15 Sep 2026 19:17:41 +0000

Use the APIOps CLI and Azure API Management to extract, review, and deploy API Management configuration as version-controlled artifacts.

Introducing Foundry Dev Pack: One Command to Start Building

Tue, 15 Sep 2026 19:00:00 +0000

Foundry Dev Pack prepares your machine for Microsoft Foundry development with an all-in-one installer for the tools you need across the terminal, VS Code, and coding agents. The post Introducing Foundry Dev Pack: One Command to Start Building appeared first on Microsoft Foundry Blog .

Connect an on-premises SAP system to the OPC UA reference solution

Tue, 15 Sep 2026 17:45:08 +0000

Learn how to connect an on-premises SAP ERP system to the OPC UA reference solution by using Azure Logic Apps and Azure Data Explorer.

Connect Dynamics 365 Field Service to the OPC UA reference solution

Tue, 15 Sep 2026 17:33:50 +0000

Learn how to use Logic Apps and Azure Data Explorer to create customer assets and IoT alerts in Dynamics 365 Field Service from industrial OPC UA telemetry.

Use career envy as a signal

Tue, 15 Sep 2026 16:29:38 +0000

Kat uses career envy as a signal. If someone's path makes you jealous, that is data about what you want. Kat Excellence writes at katexcellence.io Full episode: hanselminutes.com/1021/ #shorts

How to update a pull request comment from GitHub Actions instead of creating duplicates

Tue, 15 Sep 2026 15:07:02 +0000

Update one pull request comment from GitHub Actions instead of creating duplicates after every push, using a stable marker, ownership checks and a simple upsert pattern.