Browse All Security Content (546)

Microsoft Threat Intelligence details CaptiveCrunch, a Storm-2945 (Midnight Blizzard) campaign abusing captive portals to manipulate traffic, deliver malware, and steal credentials and tokens. The post breaks down the CornFlake and ChocoShell toolchain, device code phishing against Microsoft Entra ID, and provides Defender/Sentinel hunting queries plus practical mitigations for travelers and enterprises.

shashankamalladi outlines updated scale limits for Azure Network Security Perimeter, including new hard limits for perimeters, profiles, rule elements, and associated PaaS resources, plus what changes apply to existing configurations through the 10/31/26 transition window.

Allison announces a security change for npm: granular access tokens configured to bypass 2FA can no longer perform sensitive account, org, and package-management actions without an interactive 2FA challenge, and automated publishing should move to trusted or staged publishing.

John Savill rounds up a week of Azure platform updates, spanning AKS, networking, API Management, monitoring, data services, and regional expansion, plus a few notable AI model availability items and security-related changes like Azure Enclave and Key Vault symmetric keys.

HimanshuYadav explains how to transfer a live GitLab project to a new group without accidentally “resetting” Terraform state or breaking pipelines, focusing on what changes during a namespace move (variables, runners, identity mappings) and how to validate and roll back safely.

diptiborkar summarizes why Microsoft Fabric and OneLake were recognized as a Leader in Forrester’s 2026 Data Lakehouses report, focusing on a unified lakehouse foundation for analytics and AI, open table formats, cross-cloud interoperability, and built-in governance and security across engines like Spark, SQL, KQL, and Power BI.

arindamc explains how Workspace Outbound Access Protection (OAP) in Microsoft Fabric controls outbound connectivity for Eventstream, so streaming pipelines can only read from approved sources and write to approved destinations (including cross-workspace routes) using data connection rules.

Abhishek Tiwari explains how Azure Front Door edge actions adds customer-defined logic in the request path while keeping hyperscale performance predictable, enforcing strong tenant isolation with Hyperlight micro-VMs, and building resiliency through bounded latency, fast-fail behavior, and validated fallback mechanisms.

Alym Rayani rounds up July 2026 updates across Microsoft Security, focusing on securing AI and agent environments. The post highlights Project Perception’s agentic SecOps approach, new Microsoft Defender protections (including prompt-injection defenses and cloud agent runtime coverage), Entra identity updates like passkeys-by-default, and Purview controls for data protection and investigations.

Allison announces a new GitHub Copilot enterprise managed setting that lets organizations restrict which managed devices can host remotely controlled Copilot sessions, including options to require SSO, disable remote control, or allow it without restrictions.

ealroybrin introduces Microsoft Fabric Embed (Preview), which lets developers embed Fabric Real-Time Dashboards into JavaScript/TypeScript web apps using delegated Microsoft Entra ID authentication. The post outlines what the preview supports, key limitations (like no service principal auth), and how Fabric governance and permissions carry over to embedded experiences.

Santhosh_Ravin1 announces that Microsoft Fabric now extends customer-managed key (CMK) encryption to the Spark processing layer, covering data that Spark jobs read, write, and temporarily stage on compute clusters—aimed at meeting stricter security and compliance expectations for key control during active processing.

Bruno Borges explains how to reduce Dependabot pull request noise without slowing down vulnerability fixes, using Microsoft’s GCToolkit repo as an example. The post shows how to group version updates, move to a monthly cadence, cover all ecosystems you use, and tune the new default “cooldown” window for safer upgrades.

murray-kp rounds up the July 2026 Microsoft Fabric updates across CI/CD and Git integration, OneLake governance, Spark runtime and diagnostics, lakehouse and warehouse features, and Real-Time Intelligence improvements including Eventstream security and new connectors.

Andrew Lock explains the browser Fetch Metadata request headers (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User), what their values mean, and how servers can use them to spot suspicious cross-origin requests and add another layer of CSRF defense alongside tokens and SameSite cookies.

Allison summarizes what’s new in CodeQL 2.26.1 for GitHub code scanning, including expanded framework modeling across Go, Java/Kotlin, and JavaScript/TypeScript, plus query updates that reduce false positives and improve detection for issues like SSRF, path injection, and hard-coded cryptographic values.

Lee Stott walks through an end-to-end, production-minded approach for taking a multi-agent system from local development into Microsoft Foundry Agent Service, then distributing it to users in Microsoft Teams. The guide focuses on identity, governance, observability, and repeatable deployment using the FibreOps reference implementation.

pallakatos announces GA support for built-in CIS Benchmark auditing for Linux workloads using Azure Policy with Machine Configuration, including Azure Arc-enabled servers. The post outlines what’s included in GA, which Linux distributions and CIS benchmark versions are supported, and the basic steps to enable continuous compliance reporting in Azure.

Rafia Aqil outlines how to enable Azure Databricks’ Compliance Security Profile (CSP) for HIPAA workloads, including the September 1, 2026 deadline, required prerequisites like Azure VNet encryption and supported VM series, and a rollout approach to validate cluster startup and end-to-end connectivity before production.

stevenbucher introduces a new Compliance Substate property for Azure Policy exemptions, making it possible to see whether exempt resources would be compliant or non-compliant if the exemption were removed. The post shows where to enable the column in the Azure portal and how to query the field at scale using Azure Resource Graph.

Allison announces npm publish-time malware scanning and explains how it can delay package availability, when publishes may be held or blocked, and how maintainers can declare dual-use security functionality using new package metadata and a required DISCLOSURE file.

fredguis outlines upcoming OneLake Security changes for Microsoft Fabric SQL analytics endpoints, focusing on enterprise-friendly access control. The update improves nested group resolution, shortcut-backed table behavior in hub-and-spoke lakehouse setups, more consistent column-level security with group-based access, and broader service principal support for automated and app-owned data products.

aonelakeuser outlines summer updates to OneLake security in Microsoft Fabric, including broader engine coverage (Eventhouse and Fabric Graph), a simplified column-level security UI, faster Secure tab performance, a redesigned SQL Analytics Endpoint sync model, and generally available OneLake security APIs.

Greg Ose summarizes the security changes GitHub and npm shipped over recent months to break common supply chain attack paths, focusing on preventing workflow compromise, reducing credential exposure, slowing malicious propagation, and improving incident response options for enterprises.

Allison announces an update to Dependabot malware alerts: GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, expanding detection coverage across more ecosystems and surfacing matches as Dependabot alerts in your repos and orgs.

Allison announces a new GitHub Actions protection that automatically holds certain workflow runs flagged as potentially malicious until a collaborator with write access reviews and approves them via an authenticated web session.

Sergey Menshykh explains how .NET agents can discover and load Agent Skills directly from a Model Context Protocol (MCP) server using the Microsoft Agent Framework, so teams can publish skills centrally and have agents pull them on demand without redeploying.

Satya Nadella announces MAI-Cyber-1-Flash, a cybersecurity-focused model aimed at finding difficult vulnerabilities in large codebases, and describes how it pairs with MDASH to reduce cost while maintaining strong results. He also introduces Project Perception, an agentic security offering built around real-world signals and security workflows.

Allison announces that enterprise managed settings now apply to the GitHub Copilot app and Copilot cloud agent, letting enterprise owners enforce a single managed-settings.json policy across more Copilot clients, including controls for plugins, marketplaces, and approval-prompt bypass behavior.

vladvino announces the public preview of the AI Gateway tier for Azure API Management, focused on publishing and governing AI models and MCP servers. The post explains the new portal experience, policy-card governance (rate limits, quotas, Content Safety, fallback), and OpenTelemetry token metrics to destinations like Application Insights.

sbaynes introduces MAI-Cyber-1-Flash, Microsoft’s compact cyber-focused model used inside MDASH to handle most security tasks at lower token cost, while reserving larger models for harder cases. The post also outlines Project Perception’s agentic security workflows and the safety, governance, and enterprise controls built into deployment.

Ram Shankar Siva Kumar announces Microsoft’s External Red Team Alliance (EXTRA), a global effort to expand AI red teaming beyond internal teams by funding academic research and building an external network of specialists to test frontier AI systems across languages, regions, and domains.

Lee Stott explains why the Model Context Protocol (MCP) is becoming the standard way AI agents connect to tools and data, then shows minimal runnable MCP server examples in Python and TypeScript plus practical guidance for VS Code hosting, security, and production operations.

This week's Security roundup tracks a clear shift toward platform-enforced guardrails for both AI-assisted development and cloud operations. GitHub and Azure shipped changes that make controls more explicit and easier to standardize, from stateless MCP support and model selection safeguards in Copilot to Kubernetes-native admission policy, DDoS tuning, and tighter data plane access rules. On the supply chain side, Dependabot's default cooldown and GitHub Code Quality's PR gating aim to reduce risky churn while catching issues earlier. Threat reporting also reinforces that defenders need coverage beyond email as Teams-based lures and vishing keep growing, while incident response becomes more packaged through new insurer-aligned options.

Allison announces that Anthropic’s Claude Opus 5 is now selectable in GitHub Copilot, highlighting its strengths on long-running, multi-step coding tasks and agentic workflows, plus where it’s available, how admins enable it for Business/Enterprise, and how usage-based billing applies.

John Savill recaps a small set of Azure updates for the week of 24th July 2026, covering new capabilities across AKS, Azure Functions runtimes, networking, DDoS protection, Defender security assessments for PostgreSQL Flexible Server, and a new Log Analytics table aimed at generative AI workloads.

Allison announces that GitHub MCP Server already supports the upcoming stateless MCP specification, outlining protocol changes (like removing sessions and initialize) and what GitHub changed internally to stay compatible while improving scalability and verification.

stevenbucher explains how Azure Policy for Kubernetes can now enforce policies using Kubernetes Validating Admission Policy (VAP) with CEL, via Gatekeeper’s integration. The post contrasts the older webhook/Rego flow with in-process validation, then walks through packaging a CEL constraint template into an Azure Policy definition and rolling it out across AKS clusters.

HARMEETGILL announces the general availability of OneLake resource instance rules in Microsoft Fabric, explaining how workspace admins can allow secure service-to-service access from specific Azure resource instances (like Databricks or Azure SQL) without relying on broad IP allowlists or private networking everywhere.

OfirSarfaty announces a public preview feature for Azure DDoS Protection: custom policies that let teams set protocol-specific detection thresholds and manage per-resource mitigation behavior, while keeping existing Azure Monitor visibility and DDoS telemetry.