Microsoft Tech Community - Latest Blogs -

Securing Your Certification Authorities (Practical PKI Part 4)

RonArestia — Sun, 6 Sep 2026 21:00:00 PDT

My name is Ron Arestia, and I am a Security Researcher with Microsoft’s Detection and Response Team (DART). We respond to customer cybersecurity incidents to assist with containment and recovery from threat actors. In this blog post, we work to enhance the security position of PKI by focusing on the most vital component first: your Certification Authorities (CAs). This is part 4 of a series on practical PKI implementation based on my experience with customer interactions working as a Microsoft engineer.

Feel free to catch up on previous blog posts or jump right into this one

Secure Configuration and Hardening of Active Directory Certificate Services

Implementing and Managing an ADCS Offline Root Certificate Authority (Practical PKI Part 1)

CRL & AIA Publishing Guidance (Practical PKI Part 2)

Purpose For Your PKI (Practical PKI Part 3)

Before you start down this path, review SpectreOps Exploitation of Certificate Services framework. This is the de facto standard against which you should secure your PKI. If you cannot protect against misconfigurations, threat actors are going to leverage them against you.

Please note: I will not be demonstrating any red team/hacking tools in this blog out of an abundance of caution. There are myriad guides on how to leverage these tools against an ADCS PKI. My goal with this series is to provide best practice guidance and learn to think like a defensive security professional specific to PKI.

Throughout this and future blog posts, I am going to reference the Exploitation of Certificate Services framework as ESC and reference specific ESC exploits. Take a moment to cross-reference what is written here with the finding to understand how misconfigurations can be abused.

Root CA Security

I would advise anyone jumping into this blog series at this point to go back and review previous posts about root CA security and best practices. So much has already been written about this, so I will be brief in this section to focus on downstream security concepts.

If a root CA is truly offline and protected by an HSM, the risk of compromise is exceptionally low albeit not zero. While I do not know of any specific anecdotal evidence of an offline root CA compromise, I am sure Hollywood could produce some Mission Impossible-level script. In reality, most threat actors are maneuvering around an enterprise via the identity plane, and the PKI infrastructure is the icing on a very scrumptious cake once they have achieved domain dominance. The idea of air-gapping your root CA does not mean your enterprise is insulated from a PKI attack, but the root of trust for your organization is sufficiently protected that rebuilding the subordinate infrastructure is much quicker than having to perform a greenfield deployment of your PKI.

Recall that your root CA, as with all root CAs, leverages a self-signed certificate. That certificate is not by itself very remarkable except that it signs all of the subordinate/issuing/registration authorities AND all of the certificate revocation lists (CRLs). If a threat actor cannot compromise the root CA, in the case of a cybersecurity incident involving the subordinate infrastructure, the impacted organization can simply revoke all of the subordinate infrastructure certificates which will then be added to the CRL. That will subsequently invalidate any and all certificates issued by those subordinate CAs, but securely rebuilding the subordinate infrastructure means that an organization only needs to hydrate their issuance/registration infrastructure while the root remains trusted by the entire organization. This reduces the recovery time significantly since the root infrastructure is still trusted across the enterprise.

If your root CA is NOT offline, it needs to be. There is no way to adequately mitigate risk against your PKI if the root CA is enterprise-joined. If your root CA is also your primary issuer, you should migrate to a two-tier PKI hierarchy after assessing need and impact. Threat actors are attracted to the highest branch in your organization’s technical hierarchy. If the root CA is online, they will find it, and chances are good that they will figure out how to exploit it.

Enterprise CA Security

One piece of advice throughout this entire process: take your time. There is no reason for you to rush this process or otherwise expedite your PKI into production. “Haste makes waste,” as goes the old proverb. While it is absolutely possible to stand up a servicing infrastructure in a brief period of time, you will miss critical security controls that will put your organization at risk. Take pains to document exhaustively your desired PKI configuration: CA names, supported encryption types, minimum key sizes, certificate and CRL validity periods, template types and purposes, and groups and users used across the PKI for management of the CA, templates, and issuance. Documentation of your PKI should be the overwhelming majority of the time spent building it. Every other component falls into place with a proper framework established in advance.

Your issuers are going to be front and center to most of your PKI operations. Do not co-locate services on your issuing CAs. Your issuing CAs have a single purpose: as an enterprise issuing certificate authority. The only service installed on these systems should be the ADCS Certification Authority role. Do not install the CA role on a domain controller. (I cannot stress this enough!) Do not install any other Windows role or feature, even those under the ADCS role. Every additional role you install on your issuing CA increases its risk footprint and your administrative burden. Keep third party tools, agents, services, APIs, etc. to the bare minimum. If this is installed in Tier 0 of a properly tiered security environment, the risk should be much lower. PKI is a Tier 0 system! It should be treated with the same level of security as your domain controllers.

For both (Offline) Root and Issuing CAs, the theft of a private key is considered a domain persistence technique, and the CA should be considered compromised even if there is no evidence of exfiltration.

Proper CA Rights Management

Before you get started with your PKI implementation, you should create a handful of new security groups in Active Directory to directly manage your CAs, templates, and issuance. By default, ADCS assumes Domain Admins and Enterprise Admins are administering your PKI. Do not leave this configuration in place. This does not comply with any least privilege guidance, and it leaves your PKI in a position where it can be compromised either directly or indirectly through lateral account movement once either of those groups is compromised by a threat actor.

To manage your issuing CA, create a security group named “CA Admins” or something similar that meets your organizational naming standards or needs. CA Admins have the sole responsibility of managing the CAs themselves. These are the admins who will open the Certification Authority management console (MMC), modify the CA configuration, when necessary, perform signing operations (e.g., manual CRL issuance), revoke certificates, perform backups, and maintain the overall health of the PKI. (Figure 1)

Figure 1

To manage certificate issuance for your enterprise, create a security group named “Certificate Managers” or something similar. Certificate Managers have the responsibility of scrutinizing certificates pending issuance. This should be a small group of trusted admins who are trained to review certificate requests and perform issuance based on security and risk standards established for your enterprise. (Figure 2)

Figure 2

Each of these groups will be configured in the ADCS certification authority MMC with their respective rights. Each one of these groups is single-purpose. None of them should have the ability to request certificates, and ideally, the membership of these groups should never overlap. The purpose here is to provide role separation. No one should be able to request a certificate and approve their own request, for example.

To manage certificate templates for your enterprise, create a security group named “Certificate Template Managers” or something similar. Certificate Template Managers are responsible for creation, management, and maintenance of all certificate templates in the enterprise. These individuals should have a comprehensive understanding of certificate template creation, purposeful provisioning of new templates, and management of access control lists (ACLs) on templates. These individuals are your first line of defense against misconfiguration of certificate templates that lead to compromise through many of the Exploitation of Certificate Services (ESC) methods. Note: this requires manipulation of a container in the Active Directory Configuration partition and may not be explicitly necessary if Certificate Managers is properly constrained. (Figure 3)

Figure 3

These configurations made during inception of the PKI should cover you against exploitation of ESC7 specifically and require a very narrowly-scoped attack path for a threat actor to leverage it. I want to caution that this is not foolproof and does not account for exploitation of the administrative accounts themselves. If a threat actor gains control of one of the administrative accounts, they will have exploitation capability of whatever administrative function(s) is/are in scope for that user. This is why role separation is such an important concept for PKI management. In a true cybersecurity incident, the threat actor would have to gain access to multiple accounts to take full advantage of the enterprise PKI.

Configure Role Separation at the CA

In addition to proper assignment of roles, you can enforce strict role separation by implementing the role separation registry setting for ADCS (Figure 4):

Certutil -setreg CA\RoleSeparationEnabled 1

Figure 4

Before you do this, one caution: this will force ADCS to only allow one role per account. If, for example, you have a user who is both a CA Admin and a Certificate Manager, with role separation enabled, they will not be able to perform either action. ADCS role separation role sets and only permits them to hold one. While this configuration is exceptionally strong at preventing misuse of the PKI, it can lock out your admins from administering the PKI at all! As such, you should have high confidence that your roles are properly assigned prior to changing this configuration setting. This setting is global meaning that it applies to any and all roles assigned to the PKI, not just the privileged roles.

Good news, however, is that if this happens during your testing, you can log into the CA directly and remove the role separation registry configuration. This will allow you to go back to proper configuration to resolve the overlapping identities or avoid this setting going forward but be aware of service interruption as a result.

It is possible to manage a secure PKI without this setting, however. It is one of many tools at your disposal.

Disable Request Attribute SAN (EDITF_ATTRIBUTESUBJECTALTNAME2)

Microsoft introduced strong certificate mapping limitations as part of KB5014754 in response to a number of CVEs that surfaced back in 2022 (CVE-2022-34691,CVE-2022-26931 and CVE-2022-26923). This protection makes exploitation of ESC6 difficult but not impossible. In concert with ESC9 or ESC16, this could still be exploited even with properly-patched domain controllers.

This misconfiguration (Figure 5) allows a requester to submit any subject alternative name (SAN) they want against a certificate template, even if the template does not allow it. To harden your CAs against this attack, you can make a registry change to disallow this behavior:

Certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2

Figure 5

It is important to note that if any other CA administrative escalation vulnerabilities exist, a threat actor can remove this attribute without difficulty. It does require a restart of the service, so monitoring your ADCS service health can help to identify unwanted changes.

Protect the ICertPassage RPC Interface

ESC11 is a more recent exploitation that allows relaying of NTLM authentication to RPC on a vulnerable CA. This could allow an attacker to request certificates on behalf of other domain principals. (Figure 6)

To harden your CAs against this attack, you can make a registry change to disallow this behavior:

Certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST

Figure 6

Note that this will force the CA to accept only RPC connections that are both signed and encrypted.

Check the CA Policy Module for Disabled Extensions

ESC16 covers another CA misconfiguration where a specific OID (1.3.6.1.4.1.311.25.2) is disabled in the CA Policy Module. This extension (szOID_NTDS_CA_SECURITY_EXT) will force the CA to omit a SID security extension in issued certificates which allows for exploitation of ESC6 and/or ESC7. This is functionally similar to ESC9, but this is a global setting whereas ESC9 is template-specific. (Figure 7)

To harden your CAs against this attack, review the disabled extension list on your CA:

Certutil -getreg policy\DisableExtensionList

Figure 7

If this specific OID (1.3.6.1.4.1.311.25.2) is in the disabled extension list (Figure 8), remove it:

Certutil -setreg policy\DisableExtensionList -1.3.6.1.4.1.311.25.2

Figure 8

Figure 9

Wrapping Up

As I said at the beginning of this post, take your time setting up your CAs. If you configure them with proper protections from the word “go,” you will harden your PKI sufficiently to confound even the most determined adversaries.

Of the sixteen published ESC vulnerabilities, five of them are directly attributed to CA security misconfigurations (ESC 6, 7, 8, 11, & 16). In this blog post, we provided guidance for all of these except ESC8 which deals with Certification Authority Web Enrollment (CAWE), Certificate Enrollment Service (CES), Certificate Enrollment Policy (CEP), and Network Device Enrollment Service (NDES). In my introduction, I reinforced that your Certification Authority should be single-purpose. Do NOT install other ADCS roles on your CA. You introduce risks to which the CA itself should not be exposed. If you follow this guidance, ESC8 will not present a problem, but we will cover it in more detail in a future blog post.

In Part 5, we will dive deep into the configuration of your certificate templates to address a multitude of vulnerabilities that are present from oftentimes simple misconfigurations that can lead to big headaches.

Move to Modern SQL Server Licensing with Confidence

Venkata_Raj_Pochiraju — Fri, 4 Sep 2026 17:02:23 PDT

Why eligible customers should move to pay-as-you-go licensing (PAYG)

For eligible SQL Server workloads, PAYG should be the preferred licensing approach when moving away from licenses and Software Assurance. It aligns billing with measured usage, adapts as the estate changes, and reduces the operational burden of managing fixed license quantities. The transition requires deliberate resource-configuration updates, but the result is a more flexible and manageable licensing model.

Align cost with measured usage: Adopt consumption-based billing for eligible SQL Server resources instead of maintaining fixed license allocations.
Scale without repeated license true-ups: Let billing adjust as workloads are added, removed, migrated, resized, or used intermittently.
Manage licensing through Azure: Use Azure-based controls to review resource-level licensing and improve visibility across the estate.
Reduce license administration: Spend less time tracking fixed quantities and aligning individual resources with license inventory.
Optimize committed consumption: After establishing stable PAYG usage, evaluate applicable Azure savings plans or reservations to help reduce costs.

Guidance for transitioning your resource settings

Once your organization decides to adopt PAYG for eligible SQL Server workloads, update the license configuration on each resource so billing reflects that decision. A commercial or licensing change alone does not update resource-level settings.

Plan this configuration work as part of the transition rather than treating it as a follow-up. Starting early gives teams time to validate security, networking, Azure Arc connectivity, billing, and operational processes before switching the broader estate.

Automate the transition to pay-as-you-go SQL licensing at scale

Choose the transition approach that fits your estate

PowerShell for a controlled bulk change

Use PowerShell when you need a targeted transition across a defined tenant, subscription, resource group, or resource scope.

Discover and review resources before making changes.
Test the transition with a limited scope.
Update eligible resources in bulk when the organization is ready.
Validate the resulting license configuration and billing signals.

Azure Policy for ongoing governance

Use Azure Policy to transition existing SQL resources to PAYG and continuously enforce the desired licensing configuration. Azure Policy helps identify configuration drift, maintain compliance, and automatically remediate non-compliant resources at scale.

Define the approved license configuration for eligible resources.
Assign policy at the appropriate subscription or resource group scope.
Monitor compliance through centralized Azure views.
Remediate resources that drift from the approved configuration.

Recommended path to PAYG

Commit to the PAYG target. Confirm which eligible workloads will move and identify the teams responsible for licensing, Azure, security, networking, and SQL operations.
Prepare the estate. For SQL Server running outside of Azure, connect to Azure Arc. Inventory eligible SQL resources and confirm that Azure Arc connectivity and required organizational approvals are in place.
Prove the transition. Test resource updates and billing behavior in a limited resource group or subscription.
Move at scale. Use PowerShell for a controlled bulk transition, then apply Azure Policy for ongoing governance where appropriate.
Verify and operate. Review the resulting configuration, monitor compliance, and reassess as the SQL estate grows or changes.
Evaluate commitment-based savings. After establishing a stable PAYG usage pattern, assess whether an applicable Azure savings plan or reservation could reduce costs. Review eligibility, coverage, and commitment terms with your Microsoft representative.

Learn more

Automate the transition to pay-as-you-go SQL licensing at scale

Manage licensing and billing of SQL Server enabled by Azure Arc

Pricing guidance for SQL Server on Azure VMs

Azure SQL Database pricing

Eligibility, billing treatment, prerequisites, and available licensing options vary by resource and licensing arrangement. Review the applicable Microsoft terms and product guidance, and consult your Microsoft representative or licensing specialist as needed.

Event Recap - TechCon Seattle 2026

HeatherCook — Fri, 4 Sep 2026 14:04:40 PDT

TL;DR

TechCon 365, PWRCON and DATACON Seattle 2026 August 24–28.

Five days. Three thriving technology communities. One shared destination for learning, innovation, and connection. TechCon 365, PWRCON, and DATACON Seattle 2026 brought together Microsoft 365, Power Platform, and Microsoft Data professionals for an immersive week of expert-led content, hands-on training, and meaningful networking opportunities.

Hosted at the Seattle Convention Center, the event featured 255 sessions and workshops, 36 hands-on training experiences, 131 industry experts and community leaders, and two keynote presentations exploring the future of AI, productivity, business applications, and data. Attendees had direct access to Microsoft product specialists, MVPs, and community experts through technical sessions, Ask the Experts panels, community meetups, and inclusive networking experiences designed to help every participant learn, connect, and grow.

If the player doesn’t load, open the video in a new window: Open video

Introduction

TechCon 365, PWRCON and DATACON Seattle brought together technology leaders, IT professionals, developers, architects, and innovators to the Pacific Northwest and beyond for three days of learning, collaboration, and inspiration. Attendees explored the latest advancements in AI, cloud computing, cybersecurity, workplace productivity, and emerging technologies through expert-led sessions, hands-on workshops, and engaging keynote presentations. More than just a conference, TechCon Seattle served as a hub for meaningful conversations, new connections, and practical insights that attendees can take back to their organizations. As we look back on this year's event, we're excited to share some of the highlights, key takeaways, and memorable moments that made TechCon Seattle an unforgettable experience.

Event facts

Where: Seattle Convention Center, Summit Building, 900 Pine Street, Seattle, WA 98101

255 sessions and workshops, including 36 hands-on workshops; 131 speakers; 15 sponsors; 2 keynotes

1,010 registrations; 984 onsite attendees; 67% first-time attendees; 16 countries

#techcon365 and #CommunityLuv

In a Nutshell

Microsoft’s presence was impossible to miss. Sixteen Microsoft-led, 70-minute sessions across two conference days gave attendees direct access to the people shaping the products, while two keynotes set the strategic tone. Microsoft supplied 47 of the event’s 131 speakers, representing 36% of the faculty. Beyond that core lineup, 255 sessions and workshops, including 36 hands-on workshops, let participants build an agenda around technical depth, product direction, live demos, and practical peer insight.

Why it mattered

TechCon 365, PWRCON, and DATACON Seattle brought together the professionals who drive digital transformation in organizations of every size, including IT administrators, developers, makers, architects, data specialists, business leaders, Microsoft MVPs, and community experts. The event created a unique opportunity for attendees to gain practical skills, explore emerging technologies, connect with peers facing similar challenges, and engage directly with product experts and industry thought leaders.

The audience reflected the broad impact of today's technology landscape, with strong participation from large enterprises, government organizations, and a diverse mix of technical and business roles. For many attendees, the event represented their first experience with the TechCon community, creating new opportunities for collaboration, knowledge sharing, and professional growth. By bringing together three complementary technology communities under one roof, the event fostered cross-disciplinary conversations and helped attendees discover new ideas, solutions, and connections they can bring back to their organizations and teams.

Key Content & Highlights

Microsoft keynotes

Building What’s Next for Work with Jason Moore | Wednesday, August 26, 8:30–9:40 AM

Jason Moore, Vice President of Product Management for Copilot Studio, opened the conference with a keynote on what becomes possible when Microsoft 365 Copilot, Copilot Cowork, Power Platform, and Copilot Studio are used together at scale. The session connected personal productivity, business-process transformation, agents, live demonstrations, customer stories, and enterprise governance.

From Databases to Agents: Building the Data Foundation for the Agentic Enterprise with Shireesh Thota | Thursday, August 27, 8:30–9:40 AM

Shireesh Thota, Corporate Vice President at Microsoft, focused the Data keynote on the foundation required for agentic enterprise applications. The session connected operational data, real-time context, memory, analytics, governance, and security across Azure SQL, Cosmos DB, Azure Managed Redis, Horizon DB, Microsoft Fabric and OneLake, and Rayfin.

Microsoft-led sessions

The event featured 40 70-minute sessions: 15 focused on Microsoft 365, five on Power Platform, and 20 on Data. Of these, 16 were led by Microsoft. Microsoft-led sessions. All sessions from Microsoft and community are here: All Sessions & Workshops - Microsoft 365, DATA & Power Platform Conference

Ask the Experts

Ask the Experts was scheduled in the Expo Hall on Wednesday, August 26 and Thursday, August 27. The area brought together Microsoft speakers, MVPs, and community leaders for direct, product-specific conversations with attendees.

Microsoft Community and networking

The Microsoft Community space in the Expo Hall served as the hub for meet-and-greets, community discussions, and calls to action for MGCI. The space brought together Microsoft product experts, MVPs, and community leaders to connect directly with attendees, answer questions, share resources, and discuss the latest innovations across Microsoft 365, Power Platform, Data, and AI. Designed as a welcoming community lounge, the booth offered opportunities for meet-and-greets, expert conversations, and hands-on discussions that helped attendees turn new ideas into practical solutions. 85 individual attendees were scanned in and attended the community space.

Community programming also included a Women in Tech & Allies lunch meet up session on Wednesday and a full panel "Women in Tech: Lifting as we Climb" with Rie Merritt, Karen Lopez, Mehrsa Golestaneh and Heather Cook, an MGCI meetup during lunch on Thursday led by Heather Cook & Bryan Hart, a speaker reception on Tuesday, an Expo reception, and an attendee “Luau” reception at the Hyatt Regency Seattle. Thank you to all who provided their expertise while staffing this year’s community space.

What the program achieved

TechCon 365, PWRCON and DATACON Seattle 2026 brought three technical audiences together around a 255-session-and-workshop program. Microsoft anchored that experience with two executive keynotes, 16 Microsoft-led sessions, Ask the Experts, community programming, and sustained Expo Hall engagement.

The event combined scale and specialization: 984 attendees, 255 sessions and workshops, and 36 hands-on workshops across three co-located communities.

Microsoft’s footprint was broad and visible, with 47 speakers, both keynotes, 40 company-led sessions, direct expert access, and 183 registrations attributed to Microsoft channels.

Thank you to the Microsoft production team - Microsoft Exec Producer Heather Cook, Content Lead Bryan Wofford and our partners Stephanie Lawson, Rie Merritt, and to TechCon producers Sharon Toler, David Wilhelm, Ashley Wilhelm, Liz Sundet and team for their terrific supporting the Seattle event, and to the 47 Microsoft speakers and 50 Microsoft MVPs who helped and always shape the program.

Till next year - One City, One TechCon - one event all together in TechCon in Atlanta, September 13-17, 2027

Available today: OpenAI GPT-6 Astra in Microsoft Copilot

Bas Brekelmans — Fri, 4 Sep 2026 13:20:03 PDT

GPT-6 Astra joins the frontier models available in Copilot Cowork and Copilot Studio, giving customers more choice for complex work they want to delegate to AI. Astra expands the range of work that can be handed off to Copilot. Instead of breaking work into smaller pieces and guiding it step by step, you can delegate larger tasks and focus your time on reviewing results, making decisions, and moving work forward.

As more work is delegated, the quality of the outcome depends on both the model and the context it can reason over. Work IQ grounds GPT-6 Astra in your files, meetings, chats, and business data within existing permissions, resulting in more relevant and accurate responses.

Get started today

GPT-6 Astra is rolling out today to users in Copilot Cowork and Copilot Studio.

Availability may vary by region and organization. Admins can manage access and configure availability for their organization through the Microsoft 365 admin center.

For the latest rollout information, see Roadmap and Microsoft 365 Copilot release notes.

To learn more about the model, see OpenAI's announcement of GPT-6 Astra

Check This Out! (CTO!) Guide (September 2026)

TysonPaul — Fri, 4 Sep 2026 13:18:34 PDT

Member: TysonPaul | Microsoft Community Hub

Retirement of Microsoft HPC Pack

Team Blog: Azure High Performance Computing (HPC)

Author: XinXin

Published: 08/25/2026

Summary: Microsoft HPC Pack, a Windows-based HPC scheduler, will be retired, with support ending August 27, 2027. No new updates, features, or enhancements will be provided after this date, and only limited security support is available during the retirement period. Customers are advised to migrate to Azure Batch or other Azure services for HPC workloads. Existing deployments will not be forcibly disabled but will be unsupported after the retirement date. Microsoft encourages early migration planning and feedback to facilitate a smooth transition and address customer concerns.

Azure DNS + Traffic Manager linked records

Team Blog: Azure Networking

Author: atiy

Published: 08/26/2026

Summary: Azure DNS Traffic Manager linked records allow direct, managed integration between Azure DNS and Traffic Manager profiles, enabling endpoint IP addresses to be returned without an intermediate CNAME. This improves DNS responses, supports zone-apex routing, and enhances DNSSEC compatibility while preserving Traffic Manager’s routing intelligence, health monitoring, and failover. The article provides a practical guide for configuring, validating, and testing this feature, currently in public preview, using a multi-region Contoso scenario. The feature simplifies DNS architecture and client experience, making global routing more seamless and secure, especially for root domains.

Azure Virtual Network routing appliance is now generally available

Team Blog: Azure Networking

Author: Anshu_Verma

Published: 08/04/2026

Summary: Azure Virtual Network routing appliance is now generally available, offering a managed, platform-native routing service for high-performance connectivity across Azure virtual networks. Designed for modern cloud demands—including AI, private connectivity, IPv6 adoption, and multi-region architectures—it enables scalable hub-and-spoke and private network models, simplifies operations, and supports both IPv4 and IPv6. With built-in resiliency, Azure-native management, configurable bandwidth, and integrated monitoring, it helps organizations build large-scale, efficient, and innovative network infrastructures, accelerating cloud and AI initiatives while reducing operational complexity.

Introducing the new Microsoft 365 Setup experience: A personalized dashboard for admins

Team Blog: FastTrack

Author: johnvincent

Published: 08/31/2026

Summary: Microsoft is launching a redesigned Microsoft 365 Setup experience for admins, featuring a personalized dashboard that centralizes deployment progress, onboarding, licensing, and readiness insights. The new setup offers tailored recommendations, direct product configuration, and easy access to guides and support, streamlining the deployment process. Admins can now spend less time searching and more time taking action, with integrated training, migration resources, and FastTrack support. This update aims to simplify Microsoft 365 deployments, making them more intuitive and efficient, with future enhancements planned based on admin feedback, including AI-powered insights and assistance.

Building a Fully Automated Azure Landing Zone Deployment Using Azure DevOps and Terraform

Team Blog: Azure Tools

Author: Rajasekharvemula

Published: 08/18/2026

Summary: The article explains how to build a fully automated Azure Landing Zone using Azure DevOps and Terraform. It outlines best practices for deploying standardized cloud environments, including structured Git workflows, automated CI pipelines, environment promotion strategies, governance integration, identity and access management, and monitoring. Storing Terraform state in Azure Storage ensures collaboration and recovery. Automation from the start enables consistent, secure, and auditable cloud foundations, reducing operational effort and improving compliance. Combining Azure DevOps and Terraform transforms cloud deployment into a scalable, governed, and enterprise-ready platform engineering practice.

Cost Management with Azure Resource Manager MCP

Team Blog: FinOps

Author: demiajayi

Published: 08/25/2026

Summary: Microsoft has announced new Cost Management features in Azure Resource Manager MCP, providing default tools for AI agents to integrate cost insights into Azure workflows. These tools help with cost estimation, budget tracking, and identifying savings opportunities, while optional advanced tools enable deeper analysis, forecasting, and optimization. AI agents can query costs, analyze AKS workloads, and recommend savings, streamlining financial decision-making in cloud operations. Installation and configuration details are provided for VS Code and GitHub Copilot. Microsoft plans to expand agentic cost capabilities and invites user feedback on the new tools.

Who Ordered All These Tokens? Giving AI Spend a Name in FOCUS

Team Blog: FinOps

Author: Dirk_Brinkmann

Published: 08/19/2026

Summary: The article discusses the challenge of accurately attributing AI-related costs, such as Copilot and agent spend, within enterprise billing systems. Existing cost reports scatter AI expenses across ambiguous categories, making analysis difficult. The proposed solution is to create a custom “meter map” that classifies each billing meter into meaningful attributes (like token type, provider, Copilot, or agent). This enables clear reporting and chargeback, aligning spend with business questions. The approach is flexible, ongoing, and requires ownership, but solves the gap until vendor-neutral standards evolve further.

Zonal Resiliency in Azure: Application-Centric Goals, Recovery Plans, and Drills

Team Blog: ITOps Talk

Author: Pierre_Roman

Published: 08/06/2026

Summary: The article introduces “Resiliency in Azure” (formerly Azure Business Continuity Center), a unified platform for managing and validating zonal resiliency at the application level across IaaS, PaaS, and shared services. Key features include application-centric recovery plans, tailored Azure Advisor recommendations, Copilot-guided remediation, and automated zone-down drills via Azure Chaos Studio. This approach streamlines resiliency management, supports compliance, and enables realistic failover testing, reducing manual effort and uncertainty. While not all services are supported and costs may vary, it offers a significant improvement in visibility, confidence, and operational readiness for Azure applications.

Operating Azure Backup at Scale: Day-2 Excellence for IaaS, PaaS, and Storage Workloads

Team Blog: ITOps Talk

Author: Pierre_Roman

Published: 08/11/2026

Summary: The article summarizes advancements in Azure Backup, highlighting its unified, application-centric approach for protecting IaaS, PaaS, AKS, PostgreSQL, and storage workloads. Key features include a single vault model, built-in cyber resiliency with immutability and multi-user authorization, threat detection, agentless backups, and conversational configuration via VS Code. Azure Backup offers granular restores, compliance-friendly retention tiers, and robust protection against ransomware. Real-world scenarios and actionable steps demonstrate improved operational efficiency, security, and reliability for IT professionals managing large-scale Azure environments.

Expanding the Azure Local Security Ecosystem with IBM QRadar and Splunk

Team Blog: Azure Arc

Author: Ariel Netz

Published: 08/07/2026

Summary: Microsoft has announced new integrations for Azure Local with IBM QRadar and Splunk, enabling organizations in regulated and sovereign environments to incorporate Azure Local security signals into their existing security operations platforms. This enhances monitoring, investigation, and compliance while preserving established tools and processes. Azure Local’s built-in security controls and audit logs now work seamlessly with these partner solutions, supporting flexible and resilient security operations. Microsoft is also working to expand its security ecosystem with additional partners in areas like endpoint detection, vulnerability management, and container security for Azure Local and Sovereign Private Cloud deployments.

Episode 1: Onboarding Azure Arc at Scale | The Azure Arc Check-In

Team Blog: Azure Arc

Author: Mason_Torres

Published: 08/18/2026

Summary: Episode 1 of The Azure Arc Check-In discusses strategies for onboarding large fleets of Windows and Linux servers to Azure Arc at scale. It emphasizes automation and non-interactive authentication to minimize manual effort and errors. For Linux servers, Ansible with managed identity streamlines agent deployment, while Windows servers can be onboarded using Active Directory Group Policy. The episode provides step-by-step guidance for both approaches, highlighting the importance of aligning onboarding methods with existing management tools and enabling consistent configuration and governance from day one.

Announcing General Availability of Disable Multithreading and Configurable Constrained Cores

Team Blog: Azure Compute

Author: misha-bansal

Published: 08/19/2026

Summary: Microsoft Azure has launched two new features: Disable Simultaneous Multithreading/Hyper-Threading (SMT/HT Off) and Configurable Constrained Cores. These allow customers to optimize VM performance and reduce software licensing costs by customizing vCPU configurations and disabling SMT/HT for improved performance and latency. Users can select specific vCPU counts without altering memory or storage, aiding compliance and cost efficiency. The features are available in all Azure regions, with no changes to VM pricing, and help customers tailor compute resources to their workloads, maintaining performance while controlling costs.

The OpenVMM Project

Team Blog: Windows OS Platform

Author: Caroline_Perezvargas

Published: 08/17/2026

Summary: OpenVMM is an open-source, cross-platform Virtual Machine Manager (VMM) written in Rust and released under the MIT license. It offers broad support for multiple architectures, host operating systems, and virtualization backends, and features a modular, flexible design. Since becoming open source in 2024, OpenVMM has grown with contributions from major industry partners, expanding device emulation, testing infrastructure, and confidential computing capabilities. Its modern security architecture leverages Rust, process sandboxing, and user-mode virtualization. OpenVMM is used in various environments, including Azure, and aims to provide secure, high-performance virtualization for diverse workloads.

Azure Managed Redis Deployment Automation

Team Blog: Azure PaaS

Author: LuisFilipe

Published: 08/21/2026

Summary: The article introduces a PowerShell script for automating Azure Managed Redis (AMR) deployments, especially when facing regional capacity restrictions. The script retries cache creation at random intervals, cycling through specified SKUs and configurations, and cleans up failed resources before each attempt. It supports geo-replication, clustering, high availability, and custom eviction policies. Authentication, logging, and parameter validation are included. The script is provided as-is, without support or guarantees, and users are advised to test before production use due to potential costs and risks.

Tracking Batch node state and duration in Log Analytics

Team Blog: Azure PaaS

Author: Ahmed_Khaled

Published: 08/25/2026

Summary: The article addresses gaps in Azure Batch node monitoring, such as identifying nodes stuck in certain states and automating alerts. Since Azure Monitor lacks per-node granularity, the proposed solution uses a Python script to poll Batch REST API and ingest node-level data into Log Analytics. Custom KQL queries and alerts enable precise tracking of node state, duration, and errors. The solution supports dashboards, automated remediation, and actionable alerts, and can be deployed via Azure Functions, Container Apps, or VMs. It enhances monitoring without replacing built-in metrics, providing detailed, per-node visibility for customers.

Beyond Deployment: What It Really Takes to Run GitHub Actions Runners on AKS

Team Blog: Azure Infrastructure

Author: aparnabadireddigari

Published: 08/17/2026

Summary: Deploying GitHub Actions runners on Azure Kubernetes Service (AKS) with Actions Runner Controller (ARC) is straightforward, but running it as a production platform requires much more. Key challenges involve managing authentication, network dependencies, workload isolation, image lifecycle, and observability. Production readiness demands clear ownership, validated connectivity, strong operational practices, and reliable monitoring. Naming conventions and image management become platform contracts. Ultimately, success depends on operational excellence, governance, and ownership—moving beyond a working deployment to a mature, dependable platform that reliably supports multiple teams and business-critical workflows.

Azure Copilot Introduces Direct Access to Agents

Team Blog: Azure Infrastructure

Author: artigulwadi

Published: 08/18/2026

Summary: Azure Copilot now offers direct access to specialized agents for troubleshooting, deployment, optimization, and resiliency, allowing cloud operations teams to quickly engage relevant expertise. This update streamlines workflows by matching tasks with purpose-built agents, enhancing efficiency and tailored guidance. Administrators can manage agent availability flexibly, enabling incremental adoption and better governance. Pricing remains unchanged, with most agents available at no extra cost. This evolution supports agentic cloud operations, empowering teams to operate more effectively across application and infrastructure lifecycles, with future enhancements and administrative controls expected.

Accelerate Inference on AKS with Azure Blob Storage and NVIDIA Dynamo

Team Blog: Azure Storage

Author: Vishnu Charan TJ

Published: 08/11/2026

Summary: The article details how integrating Azure Blob Storage with NVIDIA’s Dynamo stack accelerates AI inference on Azure Kubernetes Service (AKS). By using Dynamo ModelExpress and Run:ai Model Streamer, model weights are loaded up to 7.3x faster, reducing cold start latency by up to 4.6x. Offloading KV cache via NIXL to Blob Storage further lowers time-to-first-token latency by 2.8x and optimizes GPU memory use. These enhancements enable faster scaling, operational simplicity, and improved reliability for large AI models, streamlining inference workflows on AKS.

Unified AI Defense: Security Copilot, Project Perception, and MDASH

Team Blog: Core Infrastructure and Security

Author: edgarus71

Published: 08/24/2026

Summary: The article outlines Microsoft’s unified AI security platform, comprising Security Copilot, Project Perception, and MDASH. Security Copilot assists security analysts via AI-driven workflows and investigations. Project Perception orchestrates multi-agent defense, coordinating Red, Blue, and Green agents to proactively identify, validate, and remediate threats. MDASH specializes in code vulnerability discovery, validation, and remediation guidance, feeding findings into broader defense workflows. Each tool serves distinct roles—analyst assistance, coordinated defense, and deep application security—but together provide a comprehensive, layered AI security solution with human oversight and governance.

AI Skills Navigator is now available in Microsoft Copilot

Team Blog: Microsoft Learn

Author: MattErni

Published: 08/27/2026

Summary: Microsoft has integrated AI Skills Navigator into Copilot's Learning Agent, enabling users to ask questions and receive personalized AI skill recommendations directly in their workflow. This new feature tailors training, learning paths, and credentials to individual roles and goals, streamlining skill development for both individuals and organizations. Progress is tracked automatically, and learning resources from various platforms are accessible within Copilot. This integration helps connect real work tasks to relevant learning opportunities, making AI upskilling more efficient and accessible across organizations.

From GPO to Microsoft Intune: A practical guide to cloud-first policy management

Team Blog: Intune Customer Success

Author: Intune_Support_Team

Published: 08/31/2026

Summary: The article offers a practical guide for organizations transitioning from Group Policy Objects (GPOs) to Microsoft Intune for cloud-first policy management. It outlines three migration paths—starting fresh for cloud-native devices, selectively transitioning necessary settings, or coordinating GPO and Intune for hybrid environments. Key recommendations include assessing and rationalizing existing policies, avoiding direct lift-and-shift, leveraging security baselines, piloting changes, and coordinating targeting to prevent conflicts. The guide stresses the importance of tailoring management strategies to device populations and business needs, ensuring a streamlined, secure, and efficient move to modern policy management.

Introducing device association for Windows Autopilot device preparation

Team Blog: Intune Customer Success

Author: Intune_Support_Team

Published: 08/27/2026

Summary: Device association for Windows Autopilot device preparation enables organizations to securely bind Windows 11 devices to their tenant before enrollment, using hardware-backed attestation. This ensures devices are recognized as corporate-owned, allowing IT admins to apply targeted policies and configurations early, streamlining the out-of-box experience for users. The association persists through resets and reinstallation, supporting consistent lifecycle management. Device association integrates with existing Autopilot strategies, offering improved security, predictability, and a device-centric onboarding process, while simplifying setup for employees and enhancing control for IT teams.

From Features to Flow: How Real-World Adoption Reshaped the Azure Architecture Diagram Builder

Team Blog: Azure Architecture

Author: arturoqu

Published: 08/13/2026

Summary: The article discusses how real-world adoption of the open-source Azure Architecture Diagram Builder led to a shift from feature-focused development to a guided, four-stage workflow: Create, Refine, Validate & Improve, and Share or Build. User feedback revealed the importance of preserving human edits, improving diagram integrity, and ensuring validation continuity. Adoption data showed users required more than simple diagram generation—they needed iterative refinement, validation, and artifact export. The product now emphasizes workflow coherence, human judgment, and clear boundaries between logical and physical architecture, while maintaining privacy-safe feedback and ongoing open-source development.

Choosing the Right Agent in Microsoft Foundry

Team Blog: Azure Architecture

Author: supriyas

Published: 08/19/2026

Summary: The article discusses how to choose between Prompt Agents and Hosted Agents in Microsoft Foundry Agent Service. Prompt Agents are simpler, managed by Foundry, and suitable for straightforward tasks with clear instructions. Hosted Agents offer greater control, supporting complex workflows, custom code, and orchestration logic, but require more engineering responsibility. The key decision factor is runtime control—teams should start with Prompt Agents and switch to Hosted Agents only when customization or advanced orchestration is needed. Identifying runtime requirements clarifies which agent type is appropriate, minimizing risk and operational overhead.

[Now Generally Available] What-If for Azure Deployment Stacks

Team Blog: Azure Governance and Management

Author: torreyt

Published: 08/18/2026

Summary: Azure’s Stacks What-if feature is now generally available, providing detailed previews of changes before deploying Azure Deployment Stacks. It shows resource-level actions (create, modify, delete, detach), filters out false positives, and stores results as retrievable resources for use in CI pipelines. This enables safer updates by clarifying impacts, especially deletions or detachments, and supports review and approval workflows. Available across all regions and scopes via CLI, PowerShell, and SDKs, Stacks What-if addresses a top user request by enhancing deployment stack transparency and reliability.