Welcome back, everyone! Tyson Paul here with this month's "Check This Out!" (CTO!) roundup. Think of it as your monthly shortcut to the best of the Tech Community blogs. Whether you're hunting for a new skill, chasing down a stubborn problem, or just looking for your next favorite blog, we've pulled together short summaries with direct links so you can jump straight to what matters to you. Along the way, you might even find a few blogs that you didn't know existed. Thanks for reading and for your support, from all of us on the Core Infrastructure and Security Tech Community blog team!
Member: TysonPaul | Microsoft Community Hub
Azure Key Vault Control Plane API Update: Required Upgrade for Azure CLI and Azure PowerShell Users
Team Blog: Azure Tools
Author: Alex-wdy
Published: 09/01/2026
Summary: Azure Key Vault control plane API versions before 2026-02-01 will stop working on February 27, 2027. This affects only management operations, such as creating/updating vaults, network rules, access policies, and RBAC settings—not data plane operations like reading or writing secrets, keys, or certificates. Users of Azure CLI or Az PowerShell must upgrade before the deadline: Azure CLI to 2.90.0+ using `az upgrade`, or Az.KeyVault to 6.6.1+ / Az package to 16.3.0+ using `Update-Module`. Without upgrading, Key Vault management operations using older APIs will fail, with no opt-out or extension available.
Introducing bicep docs: generate documentation from your Bicep modules
Team Blog: Azure Tools
Author: jaredfholgate
Published: 09/24/2026
Summary: Bicep CLI v0.47.16 introduces the experimental `bicep docs generate` command, which creates documentation directly from Bicep modules. It generates README files covering resources, parameters, types, outputs, examples, references, and metadata, helping prevent documentation drift. Users can preview output, customize destinations, document multiple modules with patterns, and enforce freshness in CI. Documentation can be customized with Scriban templates, custom values, and alternative outputs like JSON or HTML. Usage examples are automatically discovered, and the feature is also available via JSON-RPC. Microsoft is seeking feedback as the feature evolves.
System Center 2022 Update Rollup 4
Team Blog: System Center
Author: AakashMSFT
Published: 09/29/2026
Summary: System Center 2022 Update Rollup 4 delivers stability, security, and compatibility improvements across the suite. Virtual Machine Manager adds support for newer Linux distributions, improves VM deployment/networking, console stability, authentication, and SCOM integration. Operations Manager gains OpenSSL 3.x distro support, Ubuntu 26 support, improved web console reliability, Linux monitoring, and admin-only PowerShell widget editing. Service Manager adds MSOLEDBSQL19 and Microsoft Graph API support. Orchestrator improves runbook parameter handling and updates its command-line wizard to 64-bit. Data Protection Manager enhances SQL encryption support, recovery reliability, console/PowerShell stability, and accessibility.
You Get One Exchange Left: Rethinking Azure Commitments Before February 2027
Team Blog: FinOps
Author: Madhura Amlekar
Published: 09/20/2026
Summary: Starting February 1, 2027, Azure reservations for services covered by savings plans can no longer be exchanged, except for one final exchange on reservations bought before that date. New reservations bought afterward get no exchanges. Reservations still offer deeper discounts for stable workloads, while savings plans provide flexibility across regions and SKUs. Teams should clean up unused resources, avoid committing against messy environments, and use savings plans for changing workloads before moving settled workloads to reservations. Buying at business-unit level improves chargeback and avoids duplication. The key shift is sequencing: optimize first, then commit carefully.
Now Available: Management Group–Scoped Savings Plan and Reservation Recommendations in Azure
Team Blog: FinOps
Author: Obinna_Nwokolo
Published: 09/29/2026
Summary: Azure now offers savings plan and reservation recommendations, including P3, at the management group scope in the Azure Portal and via REST API. This lets organizations assess commitment opportunities across entire subscription hierarchies in one view. The feature supports aggregated purchasing power, governance-aligned decision-making, and reduced analysis overhead for FinOps and central IT teams. Recommendations analyze historical usage, model optimal commitments, and estimate savings versus pay-as-you-go pricing. Users can access them through Azure Portal purchasing experiences or relevant Savings Plan and Reservation Recommendations API endpoints.
Microsoft and IBM bring enterprise-scale workload orchestration to Azure with IBM Spectrum Symphony
Team Blog: Azure Compute
Author: DanaCozmei
Published: 09/30/2026
Summary: Microsoft and IBM announced the IBM Spectrum Symphony Provider Plugin for Microsoft Azure Compute Fleet, enabling enterprises to extend and burst Symphony-managed HPC, AI, and analytics workloads into Azure. The integration connects Symphony’s workload orchestration with Azure’s scalable compute capacity, dynamically provisioning and releasing VMs based on demand. It supports multiple VM families, Spot and pay-as-you-go instances, and workload-based infrastructure selection to improve performance, availability, and cost efficiency. The solution helps organizations with established Symphony environments handle peak demand and large-scale batch workloads without permanently overprovisioning infrastructure.
Announcing General Availability of Azure Lasv5 and Laosv5 VMs Based on 5th Gen AMD EPYC™ processors
Team Blog: Azure Compute
Author: sarah-zhou
Published: 09/29/2026
Summary: Microsoft announced general availability of Azure Lasv5 and Laosv5 local storage-optimized VMs powered by 5th Gen AMD EPYC “Turin” processors. Built for data-intensive workloads, they offer faster compute, expanded local NVMe SSD capacity, higher IOPS, and up to 200 Gbps networking. Compared with prior generations, Lasv5 provides up to 30.7 TB local storage and 9.6M read IOPS, while Laosv5 reaches 138 TB and 20.7M read IOPS. Both support encryption by default and remote disk options. Lasv5 is available in five regions; Laosv5 is available in East US.
Automating Private Endpoint DNS Across Azure Tenants with Azure Policy and Azure Lighthouse
Team Blog: Azure Infrastructure
Author: abhilashasr
Published: 09/17/2026
Summary:In multi-tenant Azure environments, application tenants can't update the central tenant's Private DNS zones when they create Private Endpoints. The article proposes an Azure-native alternative to custom sync services. A DeployIfNotExists Azure Policy creates the private DNS zone group, using a user-assigned managed identity. Azure Lighthouse delegates that identity only Private DNS Zone Contributor on a dedicated central DNS resource group. Terraform and GitHub Actions with OIDC federation automate the rollout without long-lived secrets. The authors stress that this is a proposed design, not an official reference architecture, and should go through security review and a proof of concept first.
Expanding access to specialized GPU infrastructure through Dapple and Azure
Team Blog: Azure Infrastructure
Author: Trinidad_Salazar
Published: 09/22/2026
Summary: Microsoft is expanding access to specialized, topology-aware GPU infrastructure through Dapple integrated with Azure. Modern AI workloads depend not just on compute, but on GPU proximity, InfiniBand fabrics, low-latency networking, storage design, and cluster topology. Dapple’s Private AI Cloud provides dedicated GPU clusters while preserving Azure governance, security, and operations. Azure Kubernetes Service acts as the workload control plane, while Dapple manages infrastructure topology, maintenance, recovery, and lifecycle events. The Dapple Operator bridges both layers, enabling enterprises to run large-scale training, fine-tuning, and inference on purpose-built AI infrastructure without creating a separate operational domain.
Dell Managed PowerScale for Microsoft Azure is now generally available
Team Blog: Azure Storage
Author: AzureAndrewChen
Published: 09/10/2026
Summary: Dell Managed PowerScale for Microsoft Azure is now generally available in the East US region. Developed by Microsoft and Dell, the Azure Native ISV Service lets customers provision and manage Dell PowerScale through the Azure portal, CLI, PowerShell, and Marketplace billing while Dell operates the infrastructure, upgrades, maintenance, and support. The service offers OneFS file capabilities, private VNet access, up to 8.4 PB in a single namespace, NFS/SMB/S3 support, replication, compression, deduplication, and tiering to Azure Blob Storage. It supports hybrid data architectures, disaster recovery, analytics, and data-intensive workloads.
Accelerated AI & Analytics workload on Azure Blob Storage: Up to 25x faster List Blobs operations
Team Blog: Azure Storage
Author: wolfgangdesalvador
Published: 09/03/2026
Summary: Azure Storage is previewing an optimized List Blobs capability that returns results in Apache Arrow format, improving listing speed by up to 25x and reducing client-side CPU use by up to 15x. Enabled through a simple header or updated SDK option, it preserves existing API behavior and strong consistency while remaining opt-in. rclone testing showed 100K-object listings dropping from 24 seconds to 1.1 seconds with Arrow and parallelism. The feature is available in preview across major Azure Blob SDKs and REST, supports flat namespace accounts, and encourages parallel listing strategies for best performance.
Locking down PAWs internet access when GSA drops
Team Blog: Core Infrastructure and Security
Author: ChristianFriedel-Jain
Published: 09/14/2026
Summary: The article explains how to make Microsoft Global Secure Access (GSA) “fail-close” for Privileged Access Workstations, since GSA currently fails open if its client, tunnels, or services stop. The authors propose an Intune-deployable defense-in-depth design: Windows Defender Firewall switches between Private and Public profiles based on GSA event logs, restricting internet access to essential Microsoft endpoints when GSA drops; and Intune custom compliance with Conditional Access blocks cloud access if GSA is missing or services are not running. Dynamic Keywords, scheduled tasks, scripts, firewall rules, and Defender hunting support deployment, maintenance, and monitoring.
MDATP Linux agent latest release reporting
Team Blog: Core Infrastructure and Security
Author: edgarus71
Published: 09/01/2026
Summary: The article describes a PowerShell 7 automation that runs on Windows to identify the latest Microsoft Defender for Endpoint (MDATP) Linux packages available in Microsoft repositories. It checks RPM and APT metadata across RHEL, Rocky, Amazon Linux, Ubuntu, Debian, and SLES for prod, insiders-slow, and insiders-fast channels. Results are exported to an Excel workbook with release details, source URLs, timestamps, status, and errors. The report supports operational release visibility, not endpoint inventory, compatibility validation, or deployment guidance. It includes setup, scheduling via Windows Task Scheduler, validation steps, risks, and timestamp clarification.
Foundry IQ with D365F&O and Fabric IQ
Team Blog: Azure Architecture
Author: Sayanika
Published: 09/18/2026
Summary: The article describes building a Microsoft Foundry agent for a retailer using Foundry IQ, Fabric IQ ontology, Web IQ, SharePoint policies, Azure AI Search, and D365 Finance & Operations via ERP MCP. The solution connects customer, store, product, sales event, procurement, inventory, policy, and external market data to answer cross-domain business questions. It helps identify procurement risks affecting promotions, recommend cities for marketing spend, validate country-specific campaign rules, assess supplier or market disruptions, and determine store/event performance. The approach enables proactive, AI-driven decisions by unifying operational, contextual, and real-time external insights.
AI Agent ROI Framework
Team Blog: Azure Architecture
Author: Yagneswari
Published: 09/10/2026
Summary: The article presents a practical framework for measuring and maximizing ROI from AI agents. It emphasizes selecting high-impact, measurable use cases; accounting for full costs including infrastructure, development, data, talent, and operations; and evaluating value beyond labor savings through productivity, financial impact, risk reduction, and strategic benefits. It recommends ROI, NPV, and sensitivity analysis for investment decisions, supported by governance models such as AI Centers of Excellence, AI FinOps, and GenAIOps. Continuous dashboards, adoption tracking, and maturity models help organizations optimize AI agents over time and treat AI as a measurable business asset.
Azure Delivers Strong MLPerf Inference v6.1 Results with NVIDIA GB300 & GB200
Team Blog: Azure High Performance Computing (HPC)
Author: Mark_Gitau
Published: 09/16/2026
Summary: Azure reported strong MLPerf Inference v6.1 results for DeepSeek-R1 on NVIDIA GB300 NVL72 and GB200 NVL72 platforms. It submitted rack-scale and cross-rack benchmarks, including GB200 at 18 and 72 nodes and GB300 at 18 nodes. Azure achieved the top reported Interactive score on GB300 and top Server and Offline scores on GB200 at both scales. The results show Azure’s infrastructure can sustain high throughput across latency-sensitive and batch workloads, reflecting the strength of its full AI system stack, including compute, networking, memory, and serving software.
Scaling AI Storage: Azure Managed Lustre excels in MLPerf Storage v3.0
Team Blog: Azure High Performance Computing (HPC)
Author: wolfgangdesalvador
Published: 09/02/2026
Summary: Azure Managed Lustre achieved leading MLPerf Storage v3.0 results among major hyperscalers for AI training and checkpointing. In CLOSED-division tests, it sustained high accelerator utilization across five service tiers and file systems from 40 TiB to 25 PiB, delivering hundreds of GiB/s over five hours. For checkpointing, it reached 642.2 GiB/s write throughput and 489.6 GiB/s recovery throughput across Llama3 model scales up to 1T. The results show Azure Managed Lustre can provide scalable, predictable POSIX storage for large AI workloads while helping reduce accelerator stalls and optimize performance, capacity, and cost.
Why long-running tasks on Linux Batch pools can restart daily and how to prevent it
Team Blog: Azure PaaS
Author: Sithu
Published: 09/01/2026
Summary: Long-running tasks on Azure Batch Ubuntu pools may restart daily because Ubuntu’s default unattended-upgrades job installs OS updates and can restart core services such as systemd. This also restarts the Batch node agent, causing Batch to treat the running task lease as lost and re-queue the task from the beginning. It is not a workload bug, Spot eviction, or Batch platform failure. You can confirm via systemd timers, apt logs, and node agent journal logs. To prevent this, disable apt daily timers using a pool start task or custom image, while managing security updates through planned maintenance.
Troubleshooting Azure Storage Deletion: Immutability, WORM, and Version Retention
Team Blog: Azure PaaS
Author: carlosbermudezlopez
Published: 09/24/2026
Summary: Azure Storage accounts can become undeletable when immutable storage, WORM retention, legal holds, or version-level immutability protect underlying blobs. Even “empty” containers may contain hidden blob versions, snapshots, or soft-deleted objects that block deletion. Unlocked policies can be removed or changed, but locked policies cannot be bypassed until retention expires. ImmutableStorageWithVersioning cannot be disabled once enabled, and all protected versions must be cleaned up. Reducing version retention triggers Lifecycle Management rules, but cleanup is asynchronous and may take 24–48+ hours. Deletion must follow the order: blobs and versions, containers, then storage account.
What’s new in Azure Firewall: Recent innovations
Team Blog: Azure Networking
Author: devanshirastogi
Published: 09/04/2026
Summary: Azure Firewall has introduced five key enhancements to support modern cloud networking. Explicit proxy is now generally available, enabling centralized HTTP/HTTPS egress control without separate proxy infrastructure. IPv6 support is in public preview, helping organizations secure dual-stack and hybrid environments. HTTP header insertion is generally available for enforcing tenant restrictions, compliance, and downstream access controls. Auto-learn SNAT routes is generally available, reducing manual No-SNAT configuration by learning routes via Azure Route Server. Azure Firewall Premium also gains IDPS performance improvements, supporting higher throughput for TLS inspection, Deny mode, and high-bandwidth enterprise workloads.
Adding network intelligence into a network-ready Azure migration plan
Team Blog: Azure Networking
Author: Sudha_Mahajan
Published: 09/09/2026
Summary: Azure Migrate is adding Network Planning to make VMware lift-and-shift migrations network-aware. The feature helps teams discover and validate source network resources, map dependencies, assess readiness, recommend Azure networking approaches such as hub-and-spoke, NSGs, Azure Firewall, load balancing, and WAF, and include network costs in business cases. It aims to reduce migration risk by connecting application, security, networking, and migration stakeholders around shared evidence. The preview focuses on practical lift-and-shift planning, not advanced modernization or automation, helping customers and partners build more complete, costed, network-ready migration plans.
Microsoft Azure Virtual Desktop Hybrid is now generally available
Team Blog: Azure Virtual Desktop
Author: Steve_Downs
Published: 09/01/2026
Summary: Microsoft announced general availability of Azure Virtual Desktop Hybrid, enabling organizations to run Azure Virtual Desktop session hosts on-premises or at the edge using existing hardware and hypervisors such as VMware vSphere, Nutanix AHV, and Hyper-V. Connected through Azure Arc, session hosts are managed from Azure while desktops and apps are delivered via the Azure Virtual Desktop cloud service over outbound HTTPS. The offering supports phased cloud migration, compliance and cost constraints, and existing infrastructure investments. It uses per-user pricing, with infrastructure costs remaining on-premises. Microsoft also highlights partner support and Windows 365 Reserve for resilience.
Now generally available: Regional resiliency for Azure Virtual Desktop
Team Blog: Azure Virtual Desktop
Author: Vidya_Iyer
Published: 09/30/2026
Summary: Microsoft announced general availability of regional host pools for Azure Virtual Desktop in East US 2 and Central US. This new deployment type stores host pool metadata in the selected Azure region, reducing cross-region dependencies and improving resiliency by containing outages to a single region. Regional host pools preserve local replicas and paired-region failover where applicable. They can be created via Azure portal or PowerShell and must be used with regional workspaces, app groups, and App Attach packages. Microsoft recommends using regional host pools for new deployments in supported regions, with migration support for existing host pools coming later.
Generally Available: Certificate Management for Azure Arc-enabled Kubernetes
Team Blog: Azure Arc
Author: NicolasMondada
Published: 09/01/2026
Summary: Microsoft has announced general availability of Certificate Management for Azure Arc-enabled Kubernetes. The new Microsoft-supported Arc extension bundles cert-manager and trust-manager to automate TLS certificate issuance, renewal, rotation, and trusted CA distribution across edge Kubernetes fleets. It supports self-signed CAs for development and enterprise CA issuers for production, reducing operational overhead and security risk. GA adds production support, offline functionality during Azure disconnection, broad regional and Kubernetes distribution coverage, and ARM64 support. Existing preview users can update to the latest version without configuration changes.
Episode 2: Reduce restarts with Hotpatch for Windows Server 2025 | The Azure Arc Check-In
Team Blog: Azure Arc
Author: Mason_Torres
Published: 09/30/2026
Summary: Hotpatch for Azure Arc-enabled Windows Server 2025 helps reduce restart-driven maintenance by applying eligible security updates in memory without rebooting. It is available at no extra charge for qualifying Standard or Datacenter servers connected to Azure Arc and meeting prerequisites such as VBS/Virtual Secure Mode, UEFI Secure Boot, supported builds, and GA releases. Enrollment is done through the Azure portal, but updates are still managed separately through tools like Windows Update or Azure Update Manager. Hotpatch does not eliminate restarts: quarterly baseline updates, unplanned baselines, and non-Hotpatch updates such as .NET, drivers, and firmware may still require rebooting.
Microsoft Intune Settings Catalog updated to support Windows 11, version 26H2
Team Blog: Intune Customer Success
Author: Intune_Support_Team
Published: 09/29/2026
Summary: Microsoft Intune now supports Windows 11, version 26H2 in the Settings Catalog, including day-zero support for validated Windows policy settings and updates to existing settings. New manageable areas include lock screen audio, MSIX allowed zones, password policies, printer driver ranking, privacy controls, and Windows Update pause/group policy settings. Administrators can configure these via the Intune admin center and should review, test, confirm compatibility, and monitor deployments. The Windows 11 26H2 security baseline is also now available, adding updated recommendations for printer driver ranking, TLS encryption support, and future NetBIOS settings.
Moving from Windows Autopilot to Windows Autopilot device preparation
Team Blog: Intune Customer Success
Author: Intune_Support_Team
Published: 09/16/2026
Summary: Microsoft recommends moving eligible user-driven Windows 11 Microsoft Entra join deployments from Windows Autopilot to Windows Autopilot device preparation. The new model simplifies provisioning through unified device preparation policies, enrollment time grouping, clearer OOBE progress, and better reporting. Organizations should transition in phases, keeping unsupported scenarios—like pre-provisioning, self-deploying, hybrid join, and co-management—on Windows Autopilot. The article outlines an eight-step migration approach: define eligible populations, design groups, map policies, assess device association, pilot, expand in waves, and retire old flows only after validation. Existing devices can be pre-associated without disruption until their next reset.
Automating Compliance Scope Enforcement with Azure Policy
Team Blog: Azure Governance and Management
Author: gurjsing
Published: 09/01/2026
Summary: The article explains how to enforce Azure compliance scope using Azure Policy, using Microsoft’s C5 certification as an example. It stresses that certifications cover only specific Azure services, not the whole platform, and customers remain responsible for implementation controls. The proposed process identifies the authoritative compliance document, extracts service-scope data into JSON/CSV, chooses allow-list or deny-list enforcement, maps services to ARM resource types, and deploys parameterized Azure Policy rules. Automation via GitHub workflows keeps scope data current, opens reviewed pull requests, and redeploys approved policy updates, turning compliance into repeatable “compliance as code.”
Public Preview Annoucement: Azure Policy Custom Policy Versioning!
Team Blog: Azure Governance and Management
Author: stevenbucher
Published: 09/14/2026
Summary: Azure Policy custom policy versioning is now in public preview, allowing custom definitions and initiatives to store multiple versions under one definition ID. Existing policies are backfilled to version 1.0.0. Users can create higher versions, pin assignments to major or minor versions, roll back by changing assignment references, and view version history and compliance by version. Versioning is supported in the portal, CLI, PowerShell, and REST APIs. Patch pinning is not supported, and preview limits each custom definition or initiative to four versions. Resource Provider modes and custom version overrides are not yet supported.
This Cybersecurity Awareness Month, build skills to secure the future
Team Blog: Microsoft Learn
Author: philevans
Published: 09/29/2026
Summary: Microsoft is marking Cybersecurity Awareness Month with role-based learning, events, challenges, and credentials to help people build practical security skills for an AI-powered future. Offerings include curated playlists for security, IT, developer, data, business, executive, and student audiences; the Defend the Tenant Challenge in a Microsoft 365 environment; and Cyber Genius hands-on training with Microsoft security tools. Participants can also watch “Ask a Cybersecurity Pro,” attend free global events, join the Microsoft Cybersecurity Pros community, and pursue Applied Skills or certifications to strengthen security habits, technical expertise, and organizational resilience.
Skill vs. will: What leaders must solve for AI adoption
Team Blog: Microsoft Learn
Author: WilliamNations
Published: 09/30/2026
Summary: AI adoption requires more than tool access and training. Leaders must diagnose whether barriers stem from skill gaps, employee willingness, or organizational systems. Research cited by Microsoft shows culture, manager support, and talent practices influence AI impact more than individual skill alone. Effective adoption starts with a priority workflow, role-based practice, clear responsible-use boundaries, manager modeling, aligned incentives, and outcome measurement. Hesitation may reflect unclear processes, weak governance, lack of psychological safety, or poor workflow design—not resistance. Leaders should remove system barriers and build practical capability tied to real business problems.
Bring Azure AI to your private workloads on Azure VMware Solution
Team Blog: Azure Migration and Modernization
Author: rvandenbedem
Published: 09/15/2026
Summary: The article explains how to make private Azure VMware Solution workloads accessible to Azure AI without moving data or re-platforming. It proposes using Azure AI Foundry managed agents connected through lightweight Model Context Protocol (MCP) servers running on VNet-integrated Azure Container Apps, with private ExpressRoute connectivity to VMware workloads. A SQL example shows read-only querying across two private databases using managed identity, Key Vault, and strict governance controls. The pattern can extend to file shares, APIs, NoSQL, and legacy systems, enabling secure, repeatable AI access to private enterprise data in place.
Microsoft