Browse Security Community (108)

Nivas Narayanasamy lays out a practical architecture for making private Azure VMware Solution workloads reachable by Azure AI Foundry agents without moving data. The post shows how to use MCP “bridge” servers on VNet-integrated Azure Container Apps, with ExpressRoute, private endpoints, Entra managed identity, and Key Vault-backed secrets to keep access private and read-only.

Mayuri Gupta announces the public preview of Azure Red Hat OpenShift hosted control planes, explaining how the control plane can run as a Microsoft-managed service while worker nodes stay in the customer subscription. The post covers operational benefits, Azure integrations (identity, monitoring, IaC), security controls, supported regions, and preview pricing.

Pamela_Fox shares the full set of MCP Live session recordings and resources, covering the Model Context Protocol’s latest spec updates, MCP server/client development in VS Code and GitHub Copilot, enterprise governance with Microsoft Foundry Toolboxes, and evolving MCP authentication patterns.

nzthiago explains the new GA support for site-scoped certificates and end-to-end TLS in Azure Functions Flex Consumption, including certificate sources (Key Vault, managed certs, uploads), how to expose certs to code on Linux workers, and how to implement inbound and outbound mutual TLS safely.

Gaurav Bhardwaj walks through a practical “refund agent” example to show why AI agent observability needs more than green HTTP checks, and how to use Microsoft Foundry plus Azure Monitor (Application Insights and Log Analytics) to trace runs, evaluate tool-call correctness, set alerts, and bake in security and privacy controls.

kedikala lays out a practical security framework for agentic apps on Azure, focusing on how to keep tool calls safe when untrusted content can steer an agent toward sensitive reads or risky writes. The post breaks controls down across identity, retrieval, request validation, execution constraints, and outcome verification.

Wiliam_Rosa breaks down how Spark Structured Streaming’s Real-time mode (as implemented in Azure Databricks) can cut anomaly-detection latency from seconds to sub-millisecond, using an Ethereum transaction pipeline that classifies events as ALLOW or QUARANTINE based on protocol invariants and sensitive-payload checks.

jordanselig explains a new public preview capability in Azure Managed Connectors: sending trigger events directly to Azure App Service apps. The post covers how the App Service destination is configured, how managed-identity callbacks are authenticated with App Service built-in auth (Easy Auth), and includes an end-to-end sample with Bicep and Azure Developer CLI.

Rohon Mohapatra explains how the Citadel reference architecture builds on AI landing zones and Microsoft Foundry to standardize enterprise AI operations—covering shared access controls, observability, identity, and security governance across multiple teams and workloads.

ellievail announces general availability of user-bound user delegation SAS for Azure Storage, which restricts a user delegation SAS token so it can only be used by a specific Microsoft Entra ID identity. The post explains how it works with RBAC, cross-tenant scenarios, and how to generate and share tokens safely.

Sudha Mahajan explains how Azure Migrate Network Planning adds network-aware discovery and assessment to VMware lift-and-shift migrations, helping teams capture dependencies, translate source constructs into Azure networking recommendations, surface readiness issues, and include network costs and security intent in the migration business case.

kshatzkamer outlines a reference architecture for “orchestrated media intelligence”: an orchestration layer that connects trusted data, specialized AI models/agents, cloud infrastructure, and governance across end-to-end media workflows. The post uses Azure OpenAI, Azure AI Speech, and Azure AI Foundry examples to show how to keep humans accountable while scaling automation.

devanshirastogi rounds up five recent Azure Firewall capabilities—some now generally available and others in public preview—covering explicit proxy support, IPv6 dual-stack filtering, HTTP header insertion, auto-learned SNAT routes via Azure Route Server, and higher-throughput IDPS with TLS inspection for Azure Firewall Premium.

rgarofalo walks through a hands-on build that locks down Azure AI Foundry both inbound (Private Endpoint) and outbound (agent egress via network injection), including the DNS zones you must create, how to prove public access is actually blocked, and how to troubleshoot opaque agent tool-call failures like 424 errors.

pranabpaul continues the 3IQ Retail Assistant demo by wiring unstructured PDF content into an Azure AI Foundry agent using Azure Blob Storage and Azure AI Search, including the RBAC permissions needed for managed identities and the networking trade-offs involved when publishing the agent to Microsoft 365 Copilot.

Mohammed Barqawi introduces Logic App Storage Inspector, a read-only Kudu site extension that helps troubleshoot Azure Logic Apps Standard by inspecting the underlying storage for workflow history, versions, and queue health, with guidance on installation, configuration settings, and managed identity permissions.

kinfey explains why “AI agent infrastructure” needs stronger security boundaries than traditional model hosting, using kars (an open-source Agent Reference Stack for Kubernetes) to show how to isolate agent runtimes, broker identity, govern tools/MCP, control egress, enforce token budgets, and produce auditable evidence for incident response.

devanshirastogi announces the general availability of explicit proxy in Azure Firewall, explaining how to steer selected HTTP/HTTPS traffic through a single proxy port for centralized inspection. The post highlights managed-identity access to PAC files in Azure Blob Storage, a streamlined portal workflow, and hybrid scenarios like securing Azure Arc connectivity over ExpressRoute or VPN.

ChethanRaj outlines a practical way to design Azure access using RBAC and Managed Identities, with an emphasis on least-privilege permissions across people, applications, and deployment pipelines. The post highlights common design mistakes and how to avoid over-scoping access (for example, granting Contributor when only Key Vault secret read is needed).

ChethanRaj outlines the key trade-offs when designing Dev, UAT, Staging, and Production environment boundaries in Azure, focusing on when to separate by resource group versus subscription, how to place shared services, and how operational and security boundaries should drive the overall structure.

ChethanRaj outlines practical considerations for structuring Dev, UAT, Staging, and Production environments in Azure, focusing on when to separate by resource group vs subscription, where to place shared services, and how operational and security boundaries should drive the design.

Alex-wdy explains an upcoming Azure Key Vault control plane API retirement and the required tooling upgrades to avoid breaking vault management operations. The post lists minimum Azure CLI and Az PowerShell versions, how to check what you have installed, and the exact upgrade commands to run before the February 27, 2027 deadline.

gurjsing shows how to turn Microsoft’s published compliance scope (using Germany’s C5 as the example) into enforceable Azure controls by extracting the certified-service list from the Service Trust Portal, mapping it to ARM resource types, and deploying a deny/audit Azure Policy with a reviewable, automated workflow.

Nicolas Mondada announces the GA release of Certificate Management for Azure Arc-enabled Kubernetes, a Microsoft-managed extension that automates TLS certificate issuance/renewal and trust bundle distribution across edge fleets, including support for disconnected operation, broad distro validation, and ARM64 edge hardware.

anishta announces GA support for sending Azure Service Bus messages directly from Azure API Management using the send-service-bus-message policy, turning APIM into a governed HTTP front door for asynchronous workloads. The post explains message property controls, failure-handling options, and securing access with Microsoft Entra managed identity and Azure RBAC.

Sudha Mahajan introduces Azure Multicloud Interconnect, a jointly engineered Microsoft and AWS managed service for private, high-throughput connectivity between Azure and AWS, aimed at reducing the operational complexity of stitching together ExpressRoute, Direct Connect, routers, BGP peering, and encryption.

AbhinavPremsekhar explains how to run authenticated browser workflows for Azure AI Foundry agents without exposing credentials to the model, using Browser Automation Tool (BAT) with Playwright Workspaces and Azure Key Vault. The post focuses on secret storage, RBAC access, just-in-time retrieval, and practical security guardrails.

tejabhutada explains how to sync multiple Azure DevOps organizations into a single ServiceNow instance without forcing teams onto a shared Azure DevOps process, outlining common multi-org scenarios, what to evaluate (filters, mappings, conflicts, security), and practical implementation options from webhooks to Azure-based middleware.

Cary Chai announces general availability of VNet integration for Azure SRE Agent and explains how it routes outbound agent traffic through your virtual network so you can reach private endpoints while still enforcing existing routes, NSG rules, firewall policies, private DNS, and network logging.

yashnisar introduces Live Reports in Azure SRE Agent (public preview), a way for ops teams to describe an operational dashboard in chat and have the agent generate a deterministic page that refreshes live data on each open. The post explains token-cost behavior, connector/tool-call mechanics, and the guardrails used to keep report execution constrained.

sanchitmehta (with co-author visagarwal) explains how Azure SRE Agent was redesigned to make autonomous operations safer by moving enforcement outside the agent’s reach—using microVM sandboxing, secretless authentication, output scrubbing, and risk-based approval so the environment, not the prompt, becomes the policy boundary.

kevinguo announces Azure Web PubSub chat (public preview), a managed chat capability on top of Azure Web PubSub that adds chat-native concepts like rooms, members, roles, ordered messages, and persistent history, with a JavaScript client SDK and a REST API for server-side control.

WSilveira explains how the MCP Connectors canvas extension for the GitHub Copilot app lets agents use hosted MCP servers from Azure Connector Namespace without manually wiring endpoints, headers, or local proxies. It also covers how the user-scoped MCP config works across the Copilot app and Copilot CLI, plus key security details.

Pamela Fox shows how to build a browser-using QA agent by combining Pydantic AI with Playwright, backed by Microsoft Foundry models. The post covers keyless Entra authentication, safe browsing constraints, and OpenTelemetry tracing with optional export to Azure Application Insights.

Rajasekharvemula outlines a practical approach to deploying an Azure Landing Zone with a repeatable pipeline using Azure DevOps and Terraform, covering Git workflow, CI validation, environment promotion, governance via Azure Policy, identity/RBAC automation, monitoring setup, and Terraform state management in Azure Storage.

lily-ma explains how to extend Azure SRE Agent with MCP servers by hosting them in Azure Connector Namespace, then wiring them into the agent’s connector experience. The post includes an end-to-end example using Azure Developer CLI (azd), managed identity auth, and access policies to connect a hosted SQL MCP server.

Teodora Sutilovic outlines what’s new in the small form factor infrastructure preview (version 2607) for Azure Local, including multi-NIC and extra disk support modeled in Azure Resource Manager, Just-in-Time access via Entra PIM with SSH certificates, and safer OS updates using an A/B image-swap rollback model.

samimodak announces the public preview of Azure DNS Traffic Manager linked records, which let Azure DNS link record sets directly to Azure Traffic Manager profiles. The post explains how this removes the trafficmanager.net CNAME hop, enables zone-apex load balancing, and improves DNSSEC compatibility and operational safety.

Mason_Torres explains how to onboard large Windows and Linux server estates to Azure Arc using non-interactive authentication and automation, focusing on two scalable approaches: Ansible for Linux fleets and Group Policy for domain-joined Windows Server environments.

Gaurav Seth announces GA for Managed Instance on Azure App Service, aimed at lifting and modernizing legacy .NET Framework apps with minimal or no code changes. The post highlights new GA capabilities like Premium v4 support, zone redundancy, deeper observability, managed identity defaults, governance/security coverage, and IaC options.