Browse Security Community (150)

Shamir AbdulAziz lays out a practical operating model for “Zero Ops” using Azure SRE Agent: agents handle investigation and remediation work, while humans focus on intent, governance, and outcome review. The post breaks down how to scope agents, connect context, build repeatable artifacts, and safely graduate from human-in-the-loop to autonomy.

Mason Torres announces the general availability of Windows Server 2016 Extended Security Updates (ESUs) enabled by Azure Arc, explaining how to onboard servers, enroll in ESUs through the Azure portal or Azure Policy, and use Azure services like Update Manager and guest configuration to manage patching and compliance.

Jatin Garg explains how to choose between Microsoft Foundry and PyRIT for AI red teaming, framing the decision around whether you’re testing a model in a managed Foundry/Azure OpenAI surface or attacking a full RAG/agent application with custom endpoints and orchestration.

Dona Mukherjee announces a public preview of Confidential Virtual Machines on Azure Local, explaining how hardware-backed memory encryption and attestation can protect data-in-use on customer-managed edge infrastructure, including how Azure Attestation and Azure Key Vault enable secure key release for sensitive workloads.

EldertGrootenboer explains why some .NET Framework WCF Relay listeners start failing against Azure Relay after TLS 1.0/1.1 retirement, and outlines practical fixes ranging from app config changes to code updates and machine-wide registry settings.

WSilveira explains how the Logic Apps Standard extension for VS Code can use Managed Identity for connectors during local development, so the same connection setup works both on your machine and after deployment. The post covers required versions, the WORKFLOWS_AUTHENTICATION_METHOD setting, and connector-specific behavior and limitations.

kinfey explains how Kars (Agent Reference Stack for Kubernetes) runs long-lived, tool-using AI agents with a tight blast radius by making the pod the trust boundary, brokering identity and egress through an in-pod router, and enforcing content safety, token budgets, and tamper-evident auditing on AKS.

aimeelittleton explains a recommended Azure outbound networking design that pairs Azure Firewall with StandardV2 NAT Gateway to get centralized inspection plus scalable, zone-resilient SNAT with predictable egress IPs, and shows what’s changed in the Azure portal create flow to set this up faster.

shashankamalladi outlines updated scale limits for Azure Network Security Perimeter, including new hard limits for perimeters, profiles, rule elements, and associated PaaS resources, plus what changes apply to existing configurations through the 10/31/26 transition window.

HimanshuYadav explains how to transfer a live GitLab project to a new group without accidentally “resetting” Terraform state or breaking pipelines, focusing on what changes during a namespace move (variables, runners, identity mappings) and how to validate and roll back safely.

Abhishek Tiwari explains how Azure Front Door edge actions adds customer-defined logic in the request path while keeping hyperscale performance predictable, enforcing strong tenant isolation with Hyperlight micro-VMs, and building resiliency through bounded latency, fast-fail behavior, and validated fallback mechanisms.

Lee Stott walks through an end-to-end, production-minded approach for taking a multi-agent system from local development into Microsoft Foundry Agent Service, then distributing it to users in Microsoft Teams. The guide focuses on identity, governance, observability, and repeatable deployment using the FibreOps reference implementation.

pallakatos announces GA support for built-in CIS Benchmark auditing for Linux workloads using Azure Policy with Machine Configuration, including Azure Arc-enabled servers. The post outlines what’s included in GA, which Linux distributions and CIS benchmark versions are supported, and the basic steps to enable continuous compliance reporting in Azure.

Rafia Aqil outlines how to enable Azure Databricks’ Compliance Security Profile (CSP) for HIPAA workloads, including the September 1, 2026 deadline, required prerequisites like Azure VNet encryption and supported VM series, and a rollout approach to validate cluster startup and end-to-end connectivity before production.

stevenbucher introduces a new Compliance Substate property for Azure Policy exemptions, making it possible to see whether exempt resources would be compliant or non-compliant if the exemption were removed. The post shows where to enable the column in the Azure portal and how to query the field at scale using Azure Resource Graph.

vladvino announces the public preview of the AI Gateway tier for Azure API Management, focused on publishing and governing AI models and MCP servers. The post explains the new portal experience, policy-card governance (rate limits, quotas, Content Safety, fallback), and OpenTelemetry token metrics to destinations like Application Insights.

Lee Stott explains why the Model Context Protocol (MCP) is becoming the standard way AI agents connect to tools and data, then shows minimal runnable MCP server examples in Python and TypeScript plus practical guidance for VS Code hosting, security, and production operations.

stevenbucher explains how Azure Policy for Kubernetes can now enforce policies using Kubernetes Validating Admission Policy (VAP) with CEL, via Gatekeeper’s integration. The post contrasts the older webhook/Rego flow with in-process validation, then walks through packaging a CEL constraint template into an Azure Policy definition and rolling it out across AKS clusters.

OfirSarfaty announces a public preview feature for Azure DDoS Protection: custom policies that let teams set protocol-specific detection thresholds and manage per-resource mitigation behavior, while keeping existing Azure Monitor visibility and DDoS telemetry.

brauerblogs shares a reminder to register for Microsoft’s “Path to Production for Agents” webinar series (July 27–28), focused on taking AI agent solutions from experimentation to secure, scalable production with guidance on governance, platform design, AgentOps, and multi-agent architecture patterns.

Kalaivanan explains how to use Azure API Management (APIM) as a control plane for Model Context Protocol (MCP) servers, focusing on enterprise-ready authentication, access control, observability, and governance. The post lays out practical patterns for putting APIM in front of MCP endpoints and using Entra ID, OAuth flows, and API Center for discovery.

Ricardo Duncan describes how CDK Global migrated a business-critical automotive CRM platform to Azure SQL Managed Instance, including the architecture choices, migration approach, and operational practices used to move more than 1,000 databases with minimal downtime.

richpaw describes a reference architecture for running Microsoft Discovery on a Windows VM in Azure and connecting it to an Azure CycleCloud HPC cluster via Azure NetApp Files (NFS) and SSH, so agentic workflows can submit Slurm jobs, read/write POSIX files, and stay inside a private network boundary.

Lee Stott invites AI engineers to a Microsoft Foundry Discord round table on using the Browser Automation Tool (BAT) to let agents drive real browser workflows via Playwright Workspaces, with a focus on setup basics, practical use cases, and the guardrails needed for responsible, auditable automation.

Jordan Selig explains how Microsoft Foundry’s new AI Gateway control plane lets platform teams create or associate an Azure API Management (APIM) gateway from the Foundry admin console, while keeping the runtime on Azure App Service. The post breaks down what Foundry now governs, what still belongs in APIM, and how to adapt an existing App Service agent sample.

VimalVerma outlines Hypervelocity Engineering (HVE) as an operating model for building and continuously evolving Azure AI Landing Zones, with a focus on platform engineering, Infrastructure as Code, Policy as Code, and security-by-design so enterprise AI platforms can scale without losing governance.

Lee Stott invites AI engineers to a Microsoft Foundry Discord round table on scaling agent apps beyond demos, focusing on how Foundry Toolbox, Skills, and Tool Search reduce tool sprawl, prompt bloat, and auth plumbing by centralizing tools behind a governed MCP endpoint with runtime discovery.

jordanselig explains the new stable Enterprise-Managed Authorization (EMA) extension for MCP and how it differs from a centrally governed OAuth setup using Microsoft Entra ID and Azure App Service Authentication. The post includes a working sample, a local EMA lab, and practical security details for deploying an Entra-governed MCP endpoint.

Suma SaganeGowda explains how Microsoft 365 built COSMIC, an internal platform layer on Azure Kubernetes Service (AKS), to standardize provisioning, deployments, security/compliance guardrails, and observability across globally distributed services so product teams can ship faster without taking on Kubernetes operational overhead.

Manasa Ramalinga lays out a practical reference map for governing enterprise AI and autonomous agents, focusing on how to turn responsible AI policy into enforceable controls, runtime visibility, and audit-ready proof using Microsoft’s governance, security, and observability services.

jordanselig shares a reference implementation for giving an AI agent both short-term conversation history and durable, user-scoped memory on Azure App Service, using Redis for bounded session history and Cosmos DB vector search for recall, with keyless auth via managed identity and a one-command azd + Bicep deployment.

akhilkarmalkar announces Azure Front Door edge actions (public preview), a way to run lightweight JavaScript during request processing at Microsoft’s global edge. The post explains where edge actions run in the Front Door pipeline, what scenarios they enable (routing, headers, auth checks), and how Hyperlight micro-VM isolation is used to keep execution secure.

jisunchoi explains how to replace “multi-model chaos” with a governed AI gateway on Azure using Azure API Management, covering cost controls (token quotas and budget-based model downgrades), security hardening (managed identity + private endpoints), observability with Application Insights, and a Terraform-based deployment you can integrate with GitHub Copilot.

abhimittal shows how to use Azure API Management (APIM) as an AI gateway in front of Azure AI Foundry to capture per-model token usage for governance. The post walks through an inbound policy that authenticates with managed identity, emits token metrics to Azure Monitor/Application Insights, and adds edge protection with Azure Front Door + WAF.

kinfey shares a reference implementation for running long-lived autonomous coding agents from Microsoft Teams, using MCP as the control plane and Azure Container Apps dynamic sessions as a Hyper-V-isolated sandbox. The post focuses on multi-agent orchestration, deployment reliability under platform timeouts, and practical security guardrails like auth, allowlists, private ingress, and managed identities.

supriyas lays out a practical, end-to-end lifecycle for building enterprise AI agents, using a banking “loan agent” example to show how to design guardrails, build with safety controls, test with evaluations and red teaming, deploy gradually, and continuously monitor and iterate using Microsoft Foundry and Azure services.

Nir Mashkowski shares customer examples of how Azure SRE Agent is being used to reduce incident triage and investigation time by having an AI-powered agent gather evidence, classify issues, and recommend next steps, with an emphasis on governance controls and operational “memory” for teams running production on Azure.

KishoreKumarPattabiraman explains why “golden paths” in platform engineering need to be treated as long-lived products, not one-off projects. Using examples like an AKS migration and identity modernization, the post lays out an operating canvas for ownership, guardrails, adoption strategy, and measurable feedback loops that keep paved paths trusted over time.

Sunita_AZ0708 documents a validated reference architecture for running Siemens Teamcenter on Azure Virtual Machines while using Oracle Exadata Database Service (Oracle Database@Azure) for the database tier, including identity integration, private cross-cloud networking, backup/recovery validation, and performance test results.

EldertGrootenboer explains how to secure Azure Service Bus namespaces using layered controls—firewall rules, service endpoints, private endpoints, and Network Security Perimeter—then ties the network layer to identity with Entra ID and managed identities, including practical notes on geo-replication and DNS.