Browse All Posts (1535)

Microsoft Security Research analyzes a malicious Claude Code-branded extension distributed through Cursor’s marketplace, detailing its attempted SSH backdoor and cross-platform persistence. The article provides Microsoft Defender detections, hunting queries, and remediation steps, explaining why removing the extension alone does not eliminate unauthorized keys and startup artifacts.

Microsoft Developer demonstrates Intelligent Terminal running a 120-billion-parameter model locally on Surface hardware with NVIDIA RTX Spark N1X and 128 GB of unified memory. The demonstration covers completing workflows such as writing new agent skills with context, without sending requests to the cloud.

Kristen Womack reviews October’s Azure Developer CLI releases, covering deployment previews, Container Apps express support, environment value removal, and extension-aware pipelines. The recap also explains stable extension APIs, breaking Go API changes, reliability fixes, and new templates for deploying semantic search and streaming AI applications to Azure.

John Savill reviews this week's Azure updates, covering Container Apps logging, confidential VMs, network security, storage quotas, and cross-tenant backup restore. The Halloween edition also covers Azure AI Foundry model cost management, Azure MCP Server 3.0, new model topics, and GitHub Universe.

Microsoft Security Research, Sagar Patil, Jesse Birch and Tal Tzhori examine two intrusions that escalated from help desk impersonation to AD CS certificate abuse. Their analysis explains ESC1 and ESC8 attack paths, contrasting containment outcomes, and practical Microsoft Defender hunting queries and hardening measures for certificate-backed identity compromise.

Michael MacKenzie, Microsoft’s VP of Product Management for Azure IoT and Digital Operations, explains how physical AI differs from traditional automation: automation repeats a task, while physical AI gets smarter each time it runs. This short introduces the distinction as part of a broader conversation on IoT and physical AI.

yunishussein explains how Azure Advisor identifies disconnected Azure Arc-enabled servers before their agent credentials expire. The guide covers heartbeat and certificate thresholds, recommended recovery actions, and ways to review affected machines through the Azure portal or query recommendations across subscriptions with Azure Resource Graph.

Microsoft Developer explores model selection using the Microsoft Foundry model catalog. By swapping only the model deployment and running the same evaluation on both options, the episode compares results alongside measured cost and latency to show when a smaller model is suitable for production and when it is not.

Visual Studio Code demonstrates how to use IntelliSense and GitHub Copilot to write, explain, and improve PostgreSQL queries without switching tools. The workflow also covers running queries and validating their results directly in the editor.

Waldek Mastykarz examines whether naming a workspace folder ‘eval’ changes GitHub Copilot CLI behavior. Across about 900 runs with four models, the name increased agents’ suspicion that they were being tested without producing statistically significant behavioral differences. The analysis explains the experiment’s controls, limitations, and practical guidance for evaluation harnesses.

John Edward covers the general availability of Microsoft Copilot Studio's tool accuracy grader, which evaluates whether AI agents select the correct tools and supply expected inputs. The feature adds execution-level checks to agent testing, while leaving response quality, downstream outcomes, and connected-system reliability as separate evaluation concerns.

Maggie Appleton, Martin Woodward, and Jocelyn Velarde close GitHub Universe 2026 with open-source perspectives and coding demos. The session explores learning with GitHub Copilot, scaling projects with AI agents, and collaborative AI planning, alongside creative experiments that highlight the craft of coding and building together.

GitHub puts attendees at GitHub Universe 2026 on the spot with three Git trivia questions. The video tests knowledge of repository forks, git blame, and blob objects, offering a quick check of familiarity with version control commands and the internal objects Git uses to store content.

spurthikommajos explains how Microsoft Fabric Eventstream’s preview support for workspace-level private connectivity lets custom applications publish events without public internet access. The article covers Azure private endpoints, workspace-scoped network restrictions, setup prerequisites, and supported analytics destinations, including important capacity requirements and ingestion limitations.

yaelbiss explains how Microsoft Fabric’s preview Allow workspace settings editing policy restricts sensitive encryption and networking changes without removing workspace administrator responsibilities. The article covers security-group-based rules, development and production boundaries, audit logging, and allow-list behavior that administrators should test before activating policies across a tenant.

Martin Woodward demonstrates how to install Super Mona on a GitHub Universe 2026 conference badge using GitHub Copilot. The demo shows copying repository instructions into Copilot Chat and letting the agent configure the app, then using the badge’s hidden capacitive buttons to play.

spurthikommajos introduces preview support for variable libraries in Microsoft Fabric Eventstream. Connection and item references let teams reuse eventstream definitions across development, staging, and production, while each workspace supplies its own resource values. The article explains configuration steps, deployment prerequisites, and how references remain intact through Git integration and deployment pipelines.

amitch and Shehab Amin explain how Sail connects Spark-compatible workloads to Microsoft OneLake without copying data. They demonstrate lakehouse transformations, Python-based embedding generation, and scoped access through LakeSail Cloud Sessions, while outlining compatibility checks and limitations of the reported performance and cost comparisons.

Microsoft Developer shows how to build a prompt agent in Microsoft Foundry using a model, instructions, and MCP tools, without managing containers or servers. The video explains when custom orchestration or a different framework calls for a hosted agent, while keeping name-based invocation consistent for callers.

Allison details three additional IP ranges for GitHub webhook deliveries, now included in the Meta API. Teams using static network allowlists need to add the prefixes to avoid rejecting deliveries. Allowlists kept current through the Meta API require no changes, and the additions apply across all github.com plans.

amitch and coauthor Iddo Avneri explain how Microsoft OneLake shortcuts expose lakeFS-managed data in Microsoft Fabric without copying datasets. Branch-following shortcuts provide current data, while commit-pinned shortcuts preserve reproducible snapshots. The article covers connection configuration, Delta table queries, validation results, and the tested configuration’s read-only limitation.

Patrick LeBlanc joins Anna Hoffman to demonstrate Database Agents in Microsoft Fabric, which detect SQL performance problems before they affect users. The episode covers Database Hub, configuration requirements, issue detection, and SQL Server Management Studio integration, alongside a longer-term vision for agents that learn from DBA interactions.

Microsoft Threat Intelligence examines how North Korean threat actors use AI to accelerate reconnaissance, identity deception, malware development, and operational scaling. The report distinguishes observed activity from suspected AI use, explains why operations remain human-directed, and provides Microsoft Defender detections and practical guidance for protecting identities, endpoints, and software repositories.

Salim Chawro introduces Hardware Audit Logging for Azure Cloud HSM, which records supported management operations directly from the hardware. Signed audit data and certificates enable independent verification, while Azure Monitor Log Analytics delivery supports investigations and monitoring. The feature is rolling out across public regions and is automatically enabled on new resources where available.

nareshvenkat introduces Project Osmos, a data engineering agent for Microsoft Fabric that investigates datasets, executes PySpark, and validates results. Persistent, shared tasks retain project context while teams define operating boundaries, review evidence, and guide changes. Tasks can be initiated through GitHub Copilot CLI, Claude Code, or Codex.

GitHub recaps the opening keynote at GitHub Universe 2026, covering a dedicated Copilot app, third-party connectors, and multi-model orchestration through Copilot Fusion. The video also highlights multi-repository agent workflows with Copilot Projects, cloud sandboxes, Code Review Max, code scanning, and architectural upgrades to Git.

Daniel Roth outlines Microsoft’s collaboration with Syncfusion on Blazor, including a free, MIT-licensed component toolkit and merged framework and scaffolding fixes. He also covers testing contributions for .NET 11 and proposed setup tooling and AI assistant skills, distinguishing available improvements from contributions still under review.

John Edward compares Azure Bicep and ARM templates, explaining their shared deployment engine and differences in syntax, validation, dependencies, and reuse. Practical Azure CLI examples show how to compile templates, preview changes, and deploy resources, while migration guidance helps teams decide when to adopt Bicep or retain existing JSON workflows.

GitHub recaps the GitHub Universe 2026 opening keynote, highlighting the new GitHub Copilot app, multi-model orchestration through Copilot Fusion, and autonomous task management in Copilot Projects. The video also covers Code Review Max for catching critical bugs and GitHub’s work to rebuild the core infrastructure underneath Git.

Michael MacKenzie explains how IoT, industrial AI, and physical AI connect machine data to decisions and actions. He outlines the roles of Azure IoT Hub, Azure IoT Operations, and Azure Device Registry, including operational inference and the policy, access, and certificate controls that bridge IT and operational technology.

vinilv explains how to upgrade Azure CycleCloud Slurm node OS images without recreating the entire VM Scale Set. The walkthrough separates cluster configuration, scale-set models, and instance state, then covers draining nodes, applying updates, validating HPC dependencies, rolling back failures, and aligning CycleCloud configuration while acknowledging node downtime and capacity limitations.

April Leonard, Jay Parikh, Cassidy Williams, Burke Holland, and Damian Brady present GitHub Universe 2026’s opening keynote. The session covers GitHub Copilot updates, autonomous agent workflows, agent-powered quality and security, and changes to GitHub’s core infrastructure, with live demonstrations of developer tools and capabilities.

LeeBenjamin introduces the generally available Govern experience in Microsoft Fabric’s OneLake catalog and the new Govern Skills collection. Together, they provide centralized estate insights, policy controls, and AI-assisted governance checks, with evidence-based recommendations and confirmation before sensitive changes through tools such as GitHub Copilot.

The Visual Studio Code Team outlines changes in VS Code 1.145 Insiders, including improved worktree cleanup, experimental previews of web apps on remote agent hosts, and new agent-session controls. The updates also address keyboard accessibility for MCP authentication prompts and add symbol breadcrumbs for unsaved files.

JPCalhau explains how to give Azure API Management v2 predictable outbound public IP addresses using virtual network integration and Azure NAT Gateway. The walkthrough covers subnet configuration, network security groups, NAT association, and validation, while explaining why backend IP allowlisting should complement rather than replace service-to-service authentication.

Satya Nadella outlines GitHub updates announced at Universe, including Copilot Fusion performance and cost claims, a unified Copilot harness in Foundry, and Copilot Projects for coordinating multiple agents across repositories. The post also notes plans to expand GitHub capacity and strengthen its architecture.

John Edward explains why hotpatch-enabled Windows Server 2022 systems will require restarts for November and December 2026 security updates. The article outlines affected devices, the planned January baseline update, and practical steps for scheduling maintenance, coordinating failover, and verifying successful installation without changing hotpatch enrollment.

SMATIN explains preview improvements to scalar user-defined functions in Microsoft Fabric Data Warehouse, including broader loop control and query support. Existing functions gain supported capabilities automatically, while new inlineability checks provide diagnostics and an explicit override for functions intentionally used without inlining.

Lynn Dai introduces Trusted Publishing for Visual Studio Marketplace, enabling extension releases from GitHub Actions and Azure Pipelines without long-lived personal access tokens. The article explains federated identity setup, GitHub policy activation, Azure Pipelines service connections, and how to migrate existing publishing workflows while verifying access before removing stored secrets.

Jeff Hollan, Viswajeeet Balaji, and Anthony Chu introduce the Microsoft Copilot harness public preview in Foundry Agent Service and generally available resilience for hosted agents. They demonstrate reusable skills and declarative deployment, explain recovery responsibilities and preview limitations, and outline consumption-based runtime billing beginning December 1, 2026.