Tyson Paul here with this month's "Check This Out!" (CTO!) roundup. Think of it as your monthly shortcut to the best of the Tech Community blogs. Whether you're hunting for a new skill, chasing down a stubborn problem, or just looking for your next favorite blog, we've pulled together short summaries with direct links so you can jump straight to what matters to you. Along the way, you might even find a few blogs that you didn't know existed. Thanks for reading and for your support, from all of us on the Core Infrastructure and Security Tech Community blog team!
Member: TysonPaul | Microsoft Community Hub
Advancing sovereign AI with Foundry Local and Azure Local
Team Blog: Azure Arc
Author: insagiv
Published: 10/20/2026
Summary: Microsoft is expanding sovereign AI with Foundry Local on Azure Local, enabling organizations to run AI models, agents, and applications in customer-controlled environments, including disconnected or regulated settings. Built on Azure Arc-enabled Kubernetes, it supports local inference, model management, GPU acceleration, enterprise data retrieval, connectors, and configurable guardrails. Together with Azure Local and GitHub Enterprise Local, it lets organizations keep sensitive data, development workflows, and AI operations under greater control. The approach gives governments, regulated industries, and critical infrastructure providers flexibility to choose cloud, local, or hybrid architectures based on workload, security, and sovereignty needs.
Simplify Azure Arc agent updates with Automatic Agent Upgrade, now generally available
Team Blog: Azure Arc
Author: yunishussein
Published: 10/28/2026
Summary: Microsoft’s Automatic Agent Upgrade for Azure Arc-enabled servers is now generally available. The feature keeps the Azure Connected Machine agent up to date by letting Microsoft manage upgrades automatically, reducing manual effort and helping servers receive security, reliability, quality, and platform improvements. Upgrades are rolled out in regional batches during off-peak hours to minimize disruption. Organizations can enable it at scale using Azure Policy, during onboarding with the `--enable-automatic-upgrade` command option, or through Azure portal onboarding scripts. Microsoft recommends reviewing the documentation for prerequisites and management options.
Understanding device redirection changes in Hyper-V Virtual Machine Connection enhanced session mode
Team Blog: Virtualization
Author: Jeff-Woolsey
Published: 10/12/2026
Summary: Starting with the October 2026 security update, Hyper-V VMConnect enhanced session mode changes device redirection defaults to improve security. The connection dialog now prominently shows Clipboard, Printers, Smart cards, and WebAuthn options. Printers, smart cards, and WebAuthn are off by default; clipboard remains on, and audio playback remains on. The change prevents sensitive credentials and devices from being shared with untrusted VMs without clear consent. Users must re-confirm saved settings once per VM and can edit them later. Microsoft recommends redirecting only needed resources, avoiding credential redirection for untrusted VMs, and using basic session mode when appropriate.
Evaluate Before Production: Evidence-Based Gates for On-Premises RAG
Team Blog: Educator Developer
Author: kevin_gatimu
Published: 10/21/2026
Summary: The article argues that on-premises RAG systems need evidence-based release gates, not demos or unverified runbooks. It outlines how evaluation must separately test routing, SQL execution, retrieval, grounding, refusal, authorization, performance, and recovery, with artifacts tied to commits, hardware, models, configuration, datasets, and outcomes. The prototype includes limited synthetic router/retrieval evaluation and CI checks, but lacks production-grade judged evaluation, capacity proof, fault-injection evidence, and clinical/compliance validation. It stresses data residency, local evaluation, exact oracles where possible, hardware-specific performance testing, and failing release gates when required evidence is missing or stale.
Fine-Tuning and Auditing an On-Device SLM Traffic Controller with Real London Data
Team Blog: Educator Developer
Author: ebenezer-isaac
Published: 10/14/2026
Summary: A UCL MSc project fine-tuned a 0.6B Qwen language model to control traffic signals in SUMO simulations using London road networks and real TfL demand shapes. Running locally on a 6GB GPU via Microsoft Foundry Local, the model used safety checks, fallbacks, fairness rules, and tamper-evident audit logs. On a calibrated Bloomsbury grid, fine-tuning cut delay 18.3% versus the stock model and matched MaxPressure, beating fixed-time control by 8.8%. On Euston Road, SUMO’s vehicle-actuated baseline remained strongest. The work is simulation-only, with future plans for richer training and inter-junction context.
Connect Azure Service Bus to other messaging systems with a JMS bridge
Team Blog: Messaging on Azure
Author: EldertGrootenboer
Published: 10/19/2026
Summary: A JMS bridge can connect existing JMS-compatible systems, such as on-premises IBM MQ, to Azure Service Bus Premium without changing current applications. Using Apache Artemis’s Jakarta JMS bridge, messages from a dedicated MQ queue are received via the IBM MQ connection factory and forwarded over AMQP 1.0/TLS to a Service Bus queue using Azure’s JMS library and Microsoft Entra ID authentication. Running the bridge on-premises keeps MQ private while opening only outbound Azure connectivity. The setup supports one-way or bidirectional flows, but with DUPLICATES_OK, duplicates are possible, so Service Bus duplicate detection and idempotent processing are recommended.
Choosing the Right Azure Virtual Machine for Ansys CFX
Team Blog: Azure High Performance Computing (HPC)
Author: Hugo_Meiland
Published: 10/21/2026
Summary: Azure VM choice for Ansys CFX should be based on solver runtime and cost per completed simulation, not hourly price or VM size. Benchmarks across HBv5, HBv4, HX, and Fams_v7 show HBv5 is fastest and most cost-effective for larger meshes, especially 50M+ nodes, due to strong scaling and memory bandwidth. HBv4 offers the lowest cost for smaller 10M-node cases. HX performs similarly to HBv4 but is useful when more memory is needed. Fams_v7’s low hourly cost can become expensive on large jobs. Users should tune MPI, measure solver time, and avoid over-provisioning ranks.
Build a Simple GPU-Enabled Kubernetes Cluster on Azure N-Series VMs
Team Blog: Azure High Performance Computing (HPC)
Author: vinilv
Published: 10/14/2026
Summary: The article explains how to build a simple two-node, GPU-enabled Kubernetes cluster on Azure using kubeadm rather than a managed service. It uses an Ubuntu control-plane VM and an Azure N-series A100 GPU worker with Kubernetes v1.33, containerd, Flannel, NVIDIA Container Toolkit, and NVIDIA device plugin. It covers node preparation, control-plane initialization, worker joining, GPU driver/runtime validation, advertising GPUs to Kubernetes, and running a PyTorch CUDA test Job. The setup is intended for development, testing, workshops, and debugging—not production—because it lacks high availability, redundant etcd, and hardened operations.
Multi-NIC Support on AKS powered by DRANET – Now in Public Preview
Team Blog: Azure Networking
Author: chandanAggarwal
Published: 10/09/2026
Summary: Microsoft announced public preview of multi-NIC support for AKS pods, powered by the managed DRANET driver. AKS can now provision worker nodes with multiple NICs on subnets in the same VNet and either attach dedicated NICs directly to pods using Kubernetes Dynamic Resource Allocation or leave them on nodes for custom VPP/DPDK/routing setups. DRANET handles discovery, allocation, attach/release, and recovery without Multus or custom CNI extensions. Dedicated pod NICs support IPv4/IPv6 and optional public IPs, but are exclusive per pod, limiting density by NIC count. Network policy applies only to the primary interface.
Proactively monitor Azure VPN Gateway tunnel disconnections
Team Blog: Azure Networking
Author: shyambasnet
Published: 10/06/2026
Summary: The article explains how to proactively monitor Azure VPN Gateway site-to-site tunnel disconnections using Azure Monitor. It recommends enabling VPN Gateway diagnostic logs, especially `TunnelDiagnosticLog`, and sending them to a Log Analytics workspace. Administrators then create an Azure Monitor alert rule scoped to the VPN Gateway, using a KQL query to detect `Disconnected` tunnel status events within the last 10 minutes. The alert triggers when one or more disconnection events occur and can notify teams via email, SMS, webhook, or action groups. This improves visibility, reduces detection time, and helps maintain reliable hybrid connectivity.
Azure CLI on macOS got security upgrade: native broker authentication
Team Blog: Azure Tools
Author: Alex-wdy
Published: 10/08/2026
Summary: Azure CLI 2.91.0 introduces preview support for native broker authentication on macOS, improving security for enterprises through OS-based credential brokering, SSO, device-bound tokens, and Conditional Access support. When enabled, `az login` uses a native macOS account picker instead of browser sign-in, falling back to browser auth if no compatible broker is available. The feature is disabled by default and can be enabled via configuration. Azure CLI is now distributed through Homebrew Cask to meet macOS broker, notarization, and compliance requirements, while preserving the familiar `brew install azure-cli` workflow.
Azure AD Graph API retirement: action required for older versions of Azure CLI and Azure PowerShell
Team Blog: Azure Tools
Author: Alex-wdy
Published: 10/05/2026
Summary: Azure AD Graph (graph.windows.net) was retired, and legacy access for old Azure CLI/Azure PowerShell releases will be progressively disabled after October 6, 2026. Current Azure CLI and Az PowerShell versions already use Microsoft Graph, so no action is needed if updated. Users should check all environments—including CI/CD, runbooks, containers, and developer machines—and upgrade Azure CLI to 2.37.0+ and Az.Resources to 5.1.0+ or later. Also migrate any direct graph.windows.net calls and legacy AzureAD/MSOnline PowerShell usage to Microsoft Graph. Targeted notifications indicate residual tenant traffic requiring investigation.
Microsoft FinOps News - September 2026
Team Blog: FinOps
Author: SoniaCuff
Published: 10/01/2026
Summary: September 2026 Microsoft FinOps News highlights cost management and AI updates across Microsoft Foundry, Azure OpenAI, Copilot, Agent 365, GitHub Copilot, and Azure. Key items include new model pricing and availability, Flex processing for lower-cost AI workloads, Foundry Routines GA, Copilot cost controls and usage dashboards, GitHub Copilot model orchestration and budgeting features, Azure savings plan and reservation recommendations, and an Azure SRE Agent trial. The roundup also covers AI transformation guidance, agent optimization economics, governance, and enterprise strategies for measuring value and controlling AI spend.
Windows CLAT is Now Generally Available
Team Blog: Networking
Author: JimAlumbaugh
Published: 10/27/2026
Summary: Windows CLAT is now generally available, helping IPv4-only applications work on IPv6-only or IPv6-mostly networks. As the client-side component of 464XLAT, it translates IPv4 traffic into IPv6 for transport to a provider-side NAT64 translator. This enables organizations to reduce IPv4 dependency, simplify network configuration, lower costs, minimize dual-stack security exposure, and support gradual IPv6 adoption. Windows CLAT works across Wi-Fi, Ethernet, and cellular interfaces, automatically detects IPv6-only networks, and supports standards-based prefix discovery via router advertisements or DNS. Microsoft says the feature will accelerate global IPv6 migration while preserving application compatibility.
Bulk changing blob tiers using Azure Storage Actions
Team Blog: Azure PaaS
Author: hqaffesha
Published: 10/07/2026
Summary: The article explains how to use Azure Storage Actions to bulk change Azure Blob access tiers without scripts or custom automation. It walks through creating a storage task in the Azure portal, defining conditions such as current access tier, setting a target tier, assigning the task to a storage account, configuring permissions and filters, and running the task. It also highlights execution reports for tracking results. Before enabling a task, users should review scope and costs, including transaction, retrieval, rehydration, and early deletion charges, especially when handling large datasets or Archive-tier blobs.
How Microsoft Intune team upgraded a .NET service with GitHub Copilot modernization
Team Blog: Apps on Azure
Author: RamyaSharma
Published: 10/27/2026
Summary: Microsoft’s Intune team used GitHub Copilot modernization to help migrate an enrollment service from .NET Framework 4.7.2 to .NET 8 while moving hosting to Azure Kubernetes Service. The agent accelerated dependency mapping, project conversion, and NuGet/API updates, cutting one internal library migration from six weeks to about 1.5 weeks. The engineer maintained control through editable migration plans, progress logs, and context notes to preserve decisions across sessions and keep pull requests small. Copilot worked well for public and Microsoft-wide libraries but required manual or custom internal context for Intune-specific dependencies.
Data Transfer and Transactions metrics now generally available for Azure Container Registry
Team Blog: Apps on Azure
Author: jeburke
Published: 10/20/2026
Summary: Azure Container Registry (ACR) has made two new Azure Monitor platform metrics generally available: Data Transfer and Transactions. These metrics are automatically enabled for all registries at no extra cost and provide deeper visibility into outbound traffic, API activity, regions, response outcomes, failures, and throttling. Users can split metrics by API name, region, and response type to diagnose traffic patterns, throttled requests, and data transfer sources. A new integrated Azure Managed Grafana dashboard offers prebuilt views for registry health, transaction trends, throttling, storage, and data transfer, enabling self-service investigation without logs or support requests.
A closer look at noise reduction in Stacks What-If
Team Blog: Azure Governance and Management
Author: torreyt
Published: 10/08/2026
Summary: Azure Deployment Stacks What-If now includes noise reduction to make change previews more trustworthy. Traditional what-if often reports false differences caused by provider defaults, read-only properties, runtime state, or unrecognized write-only fields. Stacks reduce this noise by saving a baseline after successful deployments and filtering unchanged, previously known differences from future results. It still surfaces real drift introduced after deployment. The feature is enabled automatically in all regions for stacks deployed or updated after August 13, 2026. Stacks What-If results are stored as Azure resources, available via CLI, PowerShell, SDKs, and REST.
Troubleshoot Hyper-V guarded fabrics and shielded VMs
Team Blog: ITOps Talk
Author: OrinThomas
Published: 10/16/2026
Summary: This FAQ provides troubleshooting guidance for Hyper-V guarded fabrics, Host Guardian Service (HGS), and shielded VMs. It covers deployment prerequisites, HGS service and connectivity failures, certificate and private-key issues, attestation results, TPM and code integrity problems, provisioning, key protection, migration, backup, disaster recovery, BitLocker recovery, and diagnostics. It emphasizes identifying the failing layer—host, HGS, owner keys, templates, VM state, or network—before acting. The article warns against unsafe “fixes” such as clearing TPMs, bypassing certificate validation, weakening attestation, copying private keys, or deleting protected VM state.
Before Your Next Azure VM Refresh, Revisit the PaaS Options
Team Blog: Azure Migration and Modernization
Author: Madhura Amlekar
Published: 10/23/2026
Summary: Before refreshing Azure VMs, reassess whether components should move to PaaS. Review VM lifecycle status, MANA readiness, and reservation/savings-plan implications together. Suitable candidates—web apps, APIs, databases, queues, caches, and files—may move to App Service, Container Apps, Azure SQL, Service Bus, Managed Redis, or Azure Files, while components needing OS or appliance control can remain on supported VMs. Start with a low-risk component, validate performance, security, monitoring, backup, cost, and rollback, then expand in waves. Align modernization with FinOps commitments, ownership, governance standards, and business goals rather than doing VM-by-VM refreshes.
Securing AI in the Defense Industrial Base – Part 1 – The AI Risk Landscape
Team Blog: Public Sector
Author: BrookeRobinson
Published: 10/29/2026
Summary: DIB organizations are rapidly adopting AI while needing to protect CUI, export-controlled data, IP, and mission systems under NIST 800-171/CMMC. The article frames AI security as an extension of Zero Trust, not a separate program, using NIST AI RMF concepts. It outlines risks across AI usage, applications, platforms, and autonomous agents, including shadow AI, prompt injection, poisoned data, privilege abuse, and excessive agency. It emphasizes treating agents as governed non-human identities. Existing Microsoft GCC High telemetry—Entra, Purview, Defender, Sentinel, Azure logs—can already support investigation, audit evidence, and governance.
Unleash Innovation at the Frontier: Join the Agent-a-thon
Team Blog: Public Sector
Author: Abby_Quinn
Published: 10/06/2026
Summary: The article promotes Microsoft’s Frontier Innovation Series: Agent-a-thon, a hands-on event for innovators, technologists, and business leaders to explore agentic AI. Participants will learn how intelligent agents can automate workflows, support decision-making, and address real business challenges. The event emphasizes collaboration, practical skill-building, and creating working AI solutions. It highlights the shift from AI productivity tools to transformative, organization-wide agent capabilities. Attendees will leave with actionable knowledge, use case ideas, and inspiration to apply agentic AI within their organizations.
Build and govern AI agents across a multitenant organization
Team Blog: Azure Architecture
Author: Rebekah_Midkiff
Published: 10/01/2026
Summary: The article presents a federated architecture for building and governing AI agents across multitenant enterprises using Microsoft Agent 365, Entra, Purview, Foundry, Azure API Management, and related Azure services. It centralizes standards, inventory, governance, evaluation, and operational oversight while keeping identities, data, telemetry, enforcement, and audit evidence local to each tenant. Agents are grounded in approved data, registered with owners and identities, use governed typed tools, and pass evaluations before release. Runtime controls enforce policy, classification-aware access, guardrails, and human approvals. The pattern suits large regulated or federated organizations managing many agents safely across business units.
What happens when attackers get AI too?
Team Blog: FastTrack
Author: Alexis_Tiacoh
Published: 10/21/2026
Summary: Microsoft’s article explores how attackers might use AI to accelerate or scale familiar cyberattack activities such as reconnaissance, phishing, social engineering, script modification, data analysis, and testing attack methods. It emphasizes that AI may not create entirely new threats but could reduce effort, cost, and expertise required for existing tactics. Microsoft security experts will examine realistic AI-powered attack scenarios, practical limits, and defensive controls in a live AMA webinar. The article stresses that core security fundamentals—identity, devices, applications, data, permissions, and boundaries—remain essential as attacker workflows evolve.
Azure Storage Discovery now offers advanced capacity insights
Team Blog: Azure Storage
Author: PreethiThippeswamy
Published: 10/22/2026
Summary: Azure Storage Discovery now offers preview advanced capacity insights in its Standard plan at no extra cost. By enabling “Capacity details,” users can analyze storage usage by data age, access tier, composition, object size, retention, and last access time. New charts help identify inactive Hot-tier data, soft-deleted or versioned storage, small-object inefficiencies, retention-related risks, and early deletion costs. Users can drill down from estate-wide trends to specific accounts, containers, prefixes, and tags, helping prioritize lifecycle policies, tiering, archival, cleanup, and cost-optimization decisions across complex Azure storage environments.
Sovereign controls for Oracle AI Database@Azure
Team Blog: Oracle on Azure
Author: RamKakani
Published: 10/27/2026
Summary: Oracle AI Database@Azure now supports Microsoft’s EU Data Boundary and Azure Policy, helping regulated organizations meet sovereignty, privacy, and compliance needs. Customers can deploy Oracle databases in EU/EFTA Azure regions, keep backups and replication local, use customer-managed keys, private networking, and enforce policies automatically. OCI controls govern operator access, maintenance windows, region expansion, auditing, and Oracle Data Safe for sensitive data discovery and monitoring. The article stresses that sovereignty spans Azure and OCI, requiring careful configuration of tenancy, backups, exports, diagnostics, and support data, while relying on Oracle and Microsoft compliance certifications for assurance.
Meet Microsoft at Oracle AI World 2026
Team Blog: Oracle on Azure
Author: AlexStairs
Published: 10/07/2026
Summary: Microsoft will sponsor Oracle AI World 2026, showcasing how Oracle AI Database@Azure brings Oracle data together with Microsoft AI. Attendees can hear Microsoft VP Brett Tanzer in a multicloud panel with OCI, AWS, Azure, and Google leaders, and join sessions on modernization, AI innovation, connected agents, and building AI agents on Oracle data. Additional sessions cover Oracle Database@Everywhere and real-world multicloud patterns. Visitors can stop by Microsoft booth #10028 for expert demos, cloud strategy discussions, raffle prizes, and insights into using Azure solutions to accelerate enterprise transformation.
Migrating Azure Cosmos DB Across Regions
Team Blog: Analytics on Azure
Author: Rafia_Aqil
Published: 10/15/2026
Summary: The article outlines three Azure Cosmos DB regional migration strategies: cross-region point-in-time restore, online container copy, and provisioned multi-region replication. It emphasizes distinguishing total migration time from application cutover downtime and validating target-region capacity early. PITR restore is simplest but requires a write freeze and creates a new account. Online copy minimizes downtime but is preview-based and requires empty target containers, RBAC, monitoring, and final completion. Provisioned multi-region supports HA/DR and controlled failover but increases cost and requires moving from serverless to provisioned throughput.
Optimizing Oracle-to-Power BI Performance and the Path to Modern Analytics
Team Blog: Analytics on Azure
Author: Rafia_Aqil
Published: 10/08/2026
Summary: The article explains that Oracle-to-Power BI performance issues should be diagnosed as an end-to-end pipeline, not blamed on a single component. It recommends measuring Oracle execution, provider behavior, FetchSize, network transfer, Power Query folding, model processing, and gateway performance. Key optimizations include using efficient SQL, filtering and selecting columns at the source, preserving query folding, tuning FetchSize, preferring Import with incremental refresh when possible, and optimizing DirectQuery only when necessary. For long-term scalability, Microsoft Fabric Mirroring can replicate Oracle data into OneLake, reducing analytical load on operational Oracle systems.
New GitHub Certified: Agentic AI Business Professional
Team Blog: Microsoft Learn
Author: LibertyMunson
Published: 10/20/2026
Summary: GitHub has introduced the GitHub Certified: Agentic AI Business Professional certification for business roles such as product managers, program managers, technical project managers, and analysts. It validates skills in using GitHub and GitHub Copilot to organize work, produce reliable AI-assisted outputs, build agentic workflows, automate multistep processes, and apply human oversight. No deep coding experience is required. Candidates earn it by passing the beta Exam GH-700. The first 300 eligible test takers by November 9 can receive an 80% discount using code GH700B8F5. General availability is expected in December 2026.
AI-powered + human-focused: Powering workforce transformation
Team Blog: Microsoft Learn
Author: kimberlycottrell
Published: 10/02/2026
Summary: Microsoft argues that AI transformation depends on employees having the skills, confidence, and support to use AI effectively. Its approach combines AI-powered skilling—personalized learning paths, role-based playlists, AI coaching, summaries, podcasts, assignments, and progress tracking through AI Skills Navigator—with human-focused learning that builds judgment, collaboration, creativity, curiosity, and responsible decision-making. AI enables scalable, adaptive workforce development, while human-led experiences provide context, trust, dialogue, and practice. Together, these methods help organizations tailor learning by role, readiness, and goals, turning AI adoption into measurable business impact.
Azure WAF custom rules for PHP2Shell mitigation
Team Blog: Azure Network Security
Author: saikishor
Published: 10/21/2026
Summary: Microsoft recommends upgrading to patched PHP versions as the complete fix for PHP2Shell CVE-2026-109618 and CVE-2026-109619. For customers unable to upgrade immediately, the article provides Azure WAF custom rules for Azure Front Door, Application Gateway, and AGC to reduce exposure: blocking PHP session upload progress requests and logging deeply nested URL-encoded or multipart form parameters. These rules may cause false positives and should be scoped to affected PHP routes, tested independently, started in Log mode, and moved to Block only after validation. WAF mitigations reduce selected attack patterns but are not complete protection.
Protect against Brotli CVE-2026-111497 with Azure Web Application Firewall (WAF)
Team Blog: Azure Network Security
Author: yuvalpery
Published: 10/23/2026
Summary: Google Brotli 1.0.3–1.2.0 has a buffer overflow vulnerability (CVE-2026-111497) that can enable memory corruption, data exposure, DoS, or code execution via crafted Brotli-compressed input. Microsoft recommends upgrading Brotli, Node.js, and affected applications. Azure WAF can mitigate inbound attacks by blocking Brotli request bodies: DRS 2.2 on Application Gateway/Azure Front Door Premium protects by default via rule 920450. Older rule sets, Front Door Standard, Containers, or disabled rules should use custom rules. Next.js apps should also block `_next/image` requests until patched. Request body size limits are recommended as additional protection.
Powering Azure infrastructure from grid to chip
Team Blog: Azure Infrastructure
Author: mariozeng
Published: 10/13/2026
Summary: Microsoft is rethinking Azure AI power delivery “from grid to chip” to support denser, more dynamic AI workloads. Its strategy centers on full-stack co-design, reducing conversion losses, improving resiliency, and scaling efficiency through 800VDC/±400VDC low-voltage DC distribution. Key efforts include OCP collaboration, the Mt. Diablo disaggregated power rack, solid-state transformers, integrated energy storage, clean backup power, and server-to-silicon innovations like power delivery boards and vertical power delivery. The goal is a flexible, interoperable architecture that supports existing datacenters while enabling future DC-native AI infrastructure.
Networking for the AI era: Building for scale, efficiency, and openness
Team Blog: Azure Infrastructure
Author: sdighe
Published: 10/13/2026
Summary: AI growth is making networking a core part of system architecture, not just infrastructure. Large AI clusters need scale-up, scale-out, and cross-datacenter networks that keep accelerators productive despite congestion, failures, and distributed workloads. Microsoft highlights Multipath Reliable Connection (MRC), an open OCP specification that spreads RDMA traffic across multiple paths to improve resilience and utilization. It also emphasizes open optical and Ethernet efforts such as OCI MSA and ESUN. The article argues that open standards and ecosystem collaboration are essential to building scalable, efficient, interoperable AI infrastructure.
Generally Available: Automatic Zone Balance for Virtual Machine Scale Sets
Team Blog: Azure Compute
Author: HilaryWang
Published: 10/15/2026
Summary: Azure announced general availability of automatic zone balance for Virtual Machine Scale Sets. The feature continuously monitors zonal distribution and automatically rebalances VM instances across availability zones to reduce the impact of zone failures. It uses a create-before-delete approach, health checks, cooldowns, and safeguards to preserve availability and avoid conflicts with scale operations. It also enables automatic instance repairs by default. Since preview, it adds coordination with Azure Autoscale and improved balance calculations across active, deallocated, and powered-off VMs. The feature is best for stateless workloads and requires multiple zones, zonal instances, and health monitoring.
Preparing for end of support for CNAME auto-discovery in Windows MDM-only enrollment
Team Blog: Intune Customer Success
Author: Intune_Support_Team
Published: 10/15/2026
Summary: Microsoft Intune will end support for EnterpriseEnrollment DNS CNAME-based auto-discovery in Windows MDM-only enrollment on January 15, 2027. Organizations using this method may need users to manually enter the Microsoft enrollment URL: https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc. Existing enrolled devices aren’t affected, and Windows MDM-only enrollment remains supported. Microsoft Entra join, hybrid join, and other non-CNAME methods are likely unaffected. Organizations should identify impacted workflows, review DNS records, update enrollment and support documentation, train help desk teams, test enrollment scenarios, and communicate any new steps to users before the change takes effect.
Require Google Workspace authentication on Android Enterprise devices with Microsoft Intune
Team Blog: Intune Customer Success
Author: Intune_Support_Team
Published: 10/19/2026
Summary: Microsoft Intune now generally supports requiring users on supported Android Enterprise devices to authenticate with a managed Google Workspace account. This applies to corporate-owned fully managed devices and corporate-owned devices with a work profile, but not dedicated devices. Organizations must verify their Google Workspace domain, upgrade to a managed Google domain enterprise if needed, and create managed Google accounts. Admins configure the setting in Intune’s Android Enterprise Settings catalog. Users receive a prompt to sign in with their work Google account, replacing the managed Google Play account while Microsoft Entra remains the device management identity.
Bracing for BlockNtlmv1SSO
Team Blog: Core Infrastructure and Security
Author: JerryDevore
Published: 10/23/2026
Summary: Microsoft’s October 2026 update blocks NTLMv1-derived credentials by default via BlockNtlmv1SSO, impacting environments still using MS-CHAPv2 for VPN, Wi‑Fi, NPS, or RADIUS because its challenge response is equivalent to NTLMv1. Organizations should audit for dependencies before enforcement, using NTLM events such as 4024/4025 on clients or enhanced 4033 events on domain controllers. To avoid disruption, set BlockNtlmv1SSO to 0 for audit mode before updating. Apply updates to domain controllers, forward NTLM operational logs to SIEM, and consider increasing NTLM log size if not forwarding.
Finding the Elusive MDE PUA Audit Events on Linux
Team Blog: Core Infrastructure and Security
Author: Vytas_Boyev
Published: 10/08/2026
Summary: The article explains how Microsoft Defender for Endpoint on Linux handles Potentially Unwanted Applications (PUA), especially in Audit mode. Unlike Block mode, Audit detections are not shown in the Defender portal or threat history; they are written only to local product logs. Testing with the AMTSO PUA file showed detections in `/var/log/microsoft/mdatp/microsoft_defender_core_err.log`, searchable via `potentially_unwanted_application`. The article recommends using grep for validation and Azure Monitor Agent or Log Analytics to centralize and query events at scale, making PUA Audit useful for assessing impact before enabling enforcement.
Introducing the Microsoft Sentinel ASIM EmailEvent schema
Team Blog: Microsoft Sentinel
Author: JamesAde
Published: 10/07/2026
Summary: Microsoft Sentinel has introduced the ASIM EmailEvent schema, a normalized model for email delivery and inspection events. It standardizes fields such as sender, recipients, subject, URLs, attachments, authentication results, delivery actions, and threat details across email security products. This helps analysts write consistent queries, build reusable detections, investigate faster, and integrate new email telemetry more easily. EmailEvent does not replace native product data but provides a common security layer. Version 1.0.0 includes schema definitions, parser frameworks, deployment templates, and validation support in the Azure-Sentinel repository.
Manage all your Microsoft Sentinel data in one place with Unified Data Management (Public Preview)
Team Blog: Microsoft Sentinel
Author: amybook
Published: 10/20/2026
Summary: Microsoft announced the public preview of Unified Data Management for Microsoft Sentinel in the Microsoft Defender portal. Available under Setup & configuration > Data & connectors, it centralizes connector, table, ingestion, health, schema, transformation, retention, and cost insights. The experience includes Overview, Connectors, and Tables tabs to monitor ingestion trends, troubleshoot connector issues, identify stale or high-volume tables, and manage unified and classic connectors together. It supports SIEM and XDR data operations in one place. Prerequisites include Sentinel onboarding to Defender, URBAC enabled, Data manage permissions, and appropriate Log Analytics workspace permissions.
Microsoft