https://techcommunity.microsoft.com/t5/azure/ct-p/Azure rss.livelink.threads-in-node Fri, 25 Sep 2026 15:48:37 GMT Azure 2026-09-25T15:48:37Z https://techcommunity.microsoft.com/t5/azure-paas-blog/troubleshooting-azure-storage-deletion-immutability-worm-and/ba-p/4559051 <P>One of the most common questions Azure Storage administrators ask after enabling immutable storage is:</P> <P><STRONG>"Why can't I delete my storage account anymore?"</STRONG></P> <P>Azure Immutable Storage is designed to provide WORM (Write Once, Read Many) protection, ensuring that data cannot be modified or deleted during a defined retention period. This capability is essential for compliance, regulatory, legal, and audit requirements, but it can be surprising when administrators later attempt to remove storage resources and discover that Azure refuses to delete them.<BR /><BR />In some environments, immutable storage policies may not have been configured directly by Azure Storage administrators. Backup or data protection solutions can automatically enable and manage retention settings, and storage administrators may not always have visibility into these externally managed policies.&nbsp;</P> <P>This article explains:</P> <UL> <LI>Why storage accounts become undeletable</LI> <LI>Why containers sometimes appear empty but still cannot be deleted</LI> <LI>The difference between Unlocked and Locked policies</LI> <LI>How ImmutableStorageWithVersioning changes deletion behavior</LI> <LI>What happens when version retention is reduced to one day</LI> <LI>A practical step-by-step process to remove protected resources<BR /><BR /></LI> </UL> <P><STRONG>Understanding Azure Storage Immutability</STRONG></P> <P>Azure Blob Storage supports immutability through two primary mechanisms:</P> <P><STRONG>Time-Based Retention Policies</STRONG></P> <P>A retention policy protects data for a fixed number of days. During this period: read are allowed, deletes are blocked and overwrites are blocked.</P> <P>Examples: <SPAN style="color: rgb(30, 30, 30);">7 days,</SPAN><SPAN style="color: rgb(30, 30, 30);">30 days,</SPAN><SPAN style="color: rgb(30, 30, 30);">180 days,</SPAN><SPAN style="color: rgb(30, 30, 30);">7 years</SPAN></P> <P><STRONG>Legal Holds</STRONG></P> <P>Legal holds have no expiration date. The data remains protected until the hold is manually removed. Organizations commonly use legal holds when: litigation is in progress, regulatory investigations are occurring and data preservation is legally required</P> <P><STRONG>Where Can Immutability Be Applied?</STRONG></P> <P>Azure supports immutability at two different scopes.</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><tbody><tr><td> <P>Scope</P> </td><td> <P>Description</P> </td></tr><tr><td> <P>Container-level</P> </td><td> <P>Policy protects all blobs within the container</P> </td></tr><tr><td> <P>Version-level</P> </td><td> <P>Individual blob versions receive protection</P> </td></tr></tbody><colgroup><col style="width: 50.00%" /><col style="width: 50.00%" /></colgroup></table></DIV> <P>Version-level protection requires: Blob Versioning enabled and <SPAN style="color: rgb(30, 30, 30);">ImmutableStorageWithVersioning enabled</SPAN></P> <P><STRONG>Important:</STRONG> A storage account containing immutable data may itself become protected from deletion.</P> <P><STRONG>What Happens When You Try to Delete Resources?</STRONG></P> <P>Immutability blocks deletion at multiple layers.</P> <P>Think of it as a dependency chain:</P> <P>Storage Account<BR />└─ Container<BR />&nbsp;&nbsp;&nbsp;&nbsp; └─ Blob<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; └─ Blob Version</P> <P>Azure will not allow deletion of a parent resource while protected child resources still exist.</P> <H3><STRONG>Scenario 1: Deleting the Storage Account</STRONG></H3> <P>You attempt to delete the storage account.</P> <P>Azure returns:</P> <P><EM>Failed to delete storage account 'accountname'.</EM><BR /><EM>Error: 'accountname' is protected from deletion.</EM></P> <P>&nbsp;</P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>This occurs when at least one container still contains: a<SPAN style="color: rgb(30, 30, 30);"> locked immutability policy, a</SPAN><SPAN style="color: rgb(30, 30, 30);"> legal hold or </SPAN><SPAN style="color: rgb(30, 30, 30);">Immutable blob versions</SPAN></P> <P>Before the account can be deleted: e<SPAN style="color: rgb(30, 30, 30);">very user container must be removed, e</SPAN><SPAN style="color: rgb(30, 30, 30);">very blob must be removed, e</SPAN><SPAN style="color: rgb(30, 30, 30);">very blob version must be removed and e</SPAN><SPAN style="color: rgb(30, 30, 30);">very snapshot must be removed</SPAN></P> <P><STRONG>What About System Containers?</STRONG></P> <P>System containers do not block deletion.These are managed automatically by Azure. The containers that matter are user-created containers.</P> <P>Examples: $logs, $blobchangefeed and $web</P> <H3><STRONG>Scenario 2: Deleting a Container</STRONG></H3> <P>You select Delete Container and Azure returns:</P> <P><EM>The storage account container is protected from deletion due to ImmutableStorageWithVersioning.</EM></P> <P>&nbsp;</P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><BR />Even when, the container appears empty and t<SPAN style="color: rgb(30, 30, 30);">he latest blobs have been deleted. </SPAN>Deletion may still fail. Why?</P> <P><STRONG>Previous blob versions still exist. <BR /></STRONG>This is one of the most common causes of confusion. The Azure Portal normally displays:&nbsp;<STRONG>Only Show Active Blobs</STRONG></P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>As a result, previous versions remain hidden. The container looks empty, but Azure still sees h<SPAN style="color: rgb(30, 30, 30);">istorical versions, s</SPAN><SPAN style="color: rgb(30, 30, 30);">napshots and s</SPAN><SPAN style="color: rgb(30, 30, 30);">oft-deleted objects</SPAN></P> <P>Although the container may appear empty at first glance, it is not actually empty. When <STRONG>"Show active and&nbsp; Deleted blobs"</STRONG> is enabled, the container displays all blobs that are currently in either the active or deleted state. Therefore, deletion remains blocked.</P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><BR /><BR /><STRONG>Deleting containers with immutability (WORM) policies</STRONG></P> <P>Container deletion may fail if an Immutable blob storage policy is applied at the container or version level. These policies keep blobs in a non-modifiable, delete-protected state (WORM) for the duration of the defined retention interval.</P> <P>The behavior depends on the policy State:</P> <P><STRONG>Unlocked:&nbsp;</STRONG>the policy can still be edited or removed. You must delete the immutability policy reference from the container before deleting it. Once removed, the container and its blobs can be deleted normally.</P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><BR /><BR /><STRONG>Locked:</STRONG> the policy cannot be deleted or shortened. You must wait until the retention interval expires for all affected blobs. Until that time elapses, the blobs, the container, and the storage account cannot be deleted.</P> <P>&nbsp;</P> <img /> <P>&nbsp;</P> <H3>&nbsp;</H3> <H3>&nbsp;</H3> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <H3><STRONG>Scenario 3: Deleting Individual Blobs</STRONG></H3> <P>The retention policy prevents deletion of the blob regardless of whether the Delete option appears available in the user interface. Any delete request is rejected by the Storage service until the retention period expires. This indicates that an active retention policy is protecting the blob. Until retention expires: Delete, overwrite and modification are blocked.</P> <P><STRONG>Unlocked Policies</STRONG></P> <P>Think of this state as a testing phase. Protection is active, but administrators retain management flexibility. You can, Increase or decrease the retention period, or delete the policy. Once the policy is removed, the data becomes deletable. This allows organizations to validate configurations before committing to compliance requirements.</P> <P><STRONG>Locked Policies</STRONG></P> <P>A locked policy represents a compliance commitment. After locking: the policy cannot be deleted, retention cannot be reduced or extended.</P> <P><STRONG>Most importantly:</STRONG></P> <P>No user, administrator, or Microsoft Support engineer can bypass or remove a locked retention policy before expiration. i.e If retention is configured for 180 days, deletion becomes possible only after those 180 days have passed.</P> <P><STRONG>The Hidden Detail: ImmutableStorageWithVersioning</STRONG></P> <P>A common misunderstanding is believing that removing an unlocked retention policy completely disables immutability. It does not.</P> <P>Once <STRONG>ImmutableStorageWithVersioning</STRONG> is enabled: The feature itself cannot be disabled.</P> <P>Even if every unlocked policy is deleted, Azure still requires all versions to be removed before containers and storage accounts can be deleted.</P> <P><STRONG>Why Version Retention Matters</STRONG></P> <P>Blob versioning introduces another important behavior. When you modify version retention and reduce it to a lower value, for example:</P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><BR /><BR /><BR /></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><BR />Once the version retention period is reduced (for example, from 180 days to 1 day), Azure automatically updates or creates the corresponding Lifecycle Management rule responsible for cleaning up old blob versions.</P> <P>At this stage, administrators can manually delete any remaining base blobs, snapshots, or versions that are already eligible for deletion.</P> <P>For versions that still exist and exceed the newly configured retention threshold: No additional manual action is required, the Lifecycle Management rule will automatically identify them as eligible for deletion and all versions older than the configured retention period are processed during subsequent Lifecycle Management executions.</P> <P>Example, <SPAN style="color: rgb(30, 30, 30);">If version retention is changed from 180 days to 1 day: </SPAN><SPAN style="color: rgb(30, 30, 30);">Versions created more than 1 day ago immediately become eligible for cleanup, th</SPAN><SPAN style="color: rgb(30, 30, 30);">e Lifecycle Management engine evaluates those versions during its next execution cycle and o</SPAN><SPAN style="color: rgb(30, 30, 30);">nce the versions are removed, container deletion can proceed provided no other immutable objects remain.</SPAN></P> <P><STRONG>Important Consideration</STRONG></P> <P>Lifecycle Management is an asynchronous service. Therefore, after reducing retention: <SPAN style="color: rgb(30, 30, 30);">The configuration change is applied immediately, o</SPAN><SPAN style="color: rgb(30, 30, 30);">lder versions become eligible for deletion immediately and a</SPAN><SPAN style="color: rgb(30, 30, 30);">ctual version removal may take 24-48 hours or longer, depending on the Lifecycle Management execution schedule.</SPAN></P> <P>For this reason, it is normal to see containers remain undeletable for a period of time after retention settings are modified. Administrators should allow sufficient time for Lifecycle Management to complete cleanup of all versions that exceed the configured retention threshold before attempting to delete the container or storage account.</P> <P>Azure lifecycle rule created automatically after changing the versioning retention. Many administrators are unaware that this happens behind the scenes.</P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>Code View for automatic rule created</P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><BR /><BR />The purpose is simple: Remove older blob versions once they exceed the configured age.</P> <P>Reducing the retention period does not instantly delete existing versions. Instead, it makes existing versions eligible for deletion by Lifecycle Management, which removes them asynchronously during future processing cycles.</P> <P><STRONG>Common Misconception</STRONG></P> <P>Many customers assume: "Only versions created after I changed the setting will be deleted." This is incorrect.</P> <P>Azure evaluates every version independently using its creation timestamp. If a version is already older than one day when the rule runs: It becomes eligible for deletion. There is no grandfathering mechanism.</P> <P><STRONG>Another Important Detail: Deletion Is Not Immediate</STRONG></P> <P>Lifecycle Management follows an asynchronous process.</P> <P>Typical behavior:</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><tbody><tr><td> <P>Action</P> </td><td> <P>Expected Time</P> </td></tr><tr><td> <P>New rule created</P> </td><td> <P>Immediate</P> </td></tr><tr><td> <P>Rule evaluated</P> </td><td> <P>Within 24–48 hours</P> </td></tr><tr><td> <P>Version cleanup begins</P> </td><td> <P>During next lifecycle execution</P> </td></tr></tbody><colgroup><col style="width: 50.00%" /><col style="width: 50.00%" /></colgroup></table></DIV> <P>Because of this delay, containers may remain undeletable for some time even after retention settings are updated.</P> <P><STRONG>Recommended Cleanup Process</STRONG></P> <P>When attempting to remove immutable storage resources:</P> <P>Step 1 — Inventory all protection mechanisms: <SPAN style="color: rgb(30, 30, 30);">Account-level immutability, </SPAN><SPAN style="color: rgb(30, 30, 30);">Container-level policies, </SPAN><SPAN style="color: rgb(30, 30, 30);">Blob-level policies,&nbsp;</SPAN><SPAN style="color: rgb(30, 30, 30);">Legal holds.<BR /></SPAN>Step 2 — Determine policy state: Locked or Unlocked<BR />Step 3 — Remove unlocked policies.<BR />Step 4 — Clear legal holds.<BR />Step 5 — Review versioning and soft delete settings.<BR />Step 6 — Remove all blobs, snapshots, and versions.<BR />Step 7 — Allow Lifecycle Management to remove old versions.<BR />Step 8 — Delete containers.<BR />Step 9 — Delete the storage account.</P> <P><STRONG>Important Note:&nbsp;</STRONG>The deletion order is always blobs → container → storage account. A parent resource cannot be removed while protected children remain, so if any blob is still under a Locked policy (or an active legal hold), the entire process is blocked until retention expires or the hold is cleared.</P> <P>Key Takeaways</P> <P>✅ Immutable storage protects data against deletion and modification.</P> <P>✅ Locked policies cannot be bypassed, shortened, or removed.</P> <P>✅ Legal holds must be manually cleared.</P> <P>✅ Containers that appear empty may still contain hidden versions.</P> <P>✅ ImmutableStorageWithVersioning cannot be turned off once enabled.</P> <P>✅ Blob version retention automatically creates a Lifecycle Management rule.</P> <P>✅ Storage account deletion requires every protected object underneath it to be removed first.</P> <P>&nbsp;</P> <P>References</P> <UL> <LI><A href="https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview" target="_blank" rel="noopener">https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview</A></LI> <LI><A href="https://learn.microsoft.com/azure/storage/blobs/immutable-policy-configure-container-scope" target="_blank" rel="noopener">https://learn.microsoft.com/azure/storage/blobs/immutable-policy-configure-container-scope</A></LI> <LI><A href="https://learn.microsoft.com/azure/storage/blobs/immutable-policy-configure-version-scope" target="_blank" rel="noopener">https://learn.microsoft.com/azure/storage/blobs/immutable-policy-configure-version-scope</A></LI> <LI><A href="https://learn.microsoft.com/azure/storage/blobs/data-protection-overview" target="_blank" rel="noopener">https://learn.microsoft.com/azure/storage/blobs/data-protection-overview</A></LI> <LI><A href="https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-overview" target="_blank" rel="noopener">https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-overview</A></LI> </UL> Fri, 25 Sep 2026 04:15:53 GMT https://techcommunity.microsoft.com/t5/azure-paas-blog/troubleshooting-azure-storage-deletion-immutability-worm-and/ba-p/4559051 carlosbermudezlopez 2026-09-25T04:15:53Z https://techcommunity.microsoft.com/t5/apps-on-azure-blog/getting-the-best-out-of-azure-sre-agent/ba-p/4559745 <P>A common question that we get from our customers is&nbsp;<EM>"Hey guys, we are excited about SRE agent and we 've created one but whats the best way to configure it?"</EM>. The below guide aims at sharing some of the best practices that anyone can follow to make the most out of our SRE Agent. This guide is based on SRE Agent's own scoring system and we evaluated production telemetry of the agents performing best vs. the ones performing the worst and we tried understanding the key differences that led to one agent performing better than the other.</P> <P>Interestingly, agents doing the best work are usually <STRONG>not</STRONG> the most heavier ones. Some of the strongest agents we looked at had just one skill. On the other hand, some of the worst performing agents had large skill libraries, plenty of connectors, and insane number of tools. The difference almost always comes down to one thing: <STRONG>"whether the right work reaches the right handler"</STRONG></P> <P>This guide walks through what to set up, roughly in the order you'd do it. It's written for someone configuring an agent for the first time, so it starts simple.</P> <H2 id="the-seven-things-that-matter">The seven things that matter</H2> <P>These are written in the order you'll most likely execute on them. "How much it matters" shows how much each aspect makes an agent significantly better (the goal is to help you quickly decide which ones to prioritize).</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table><thead><tr><th>&nbsp;</th><th>What to do</th><th>How much it matters</th></tr></thead><tbody><tr><td><STRONG>1</STRONG></td><td>Connect your data first</td><td><STRONG>Critical</STRONG> — everything else depends on it</td></tr><tr><td><STRONG>2</STRONG></td><td>Start with the problem that annoys you most</td><td>How to begin</td></tr><tr><td><STRONG>3</STRONG></td><td>Send the right incidents to the right specialist</td><td><STRONG>Critical</STRONG> — filter incidents in the response plan, not in the agent's instructions</td></tr><tr><td><STRONG>4</STRONG></td><td>Write a few skills that really teach something</td><td>Worth getting right</td></tr><tr><td><STRONG>5</STRONG></td><td>Add custom agents when different problems need different help</td><td>Worth getting right</td></tr><tr><td><STRONG>6</STRONG></td><td>Decide how much freedom to give, scenario by scenario</td><td><STRONG>High</STRONG> — can leave work waiting for approval</td></tr><tr><td><STRONG>7</STRONG></td><td>Check the agent can finish the job</td><td><STRONG>High</STRONG> — check permissions for the final step</td></tr></tbody></table></DIV> <H2 id="start-here-the-one-idea-that-is-worth-internalising">Start here: The One idea that is worth internalising</H2> <P>Think of your agent less like an AI system but more like a new hire in your team, even though its hard to visulaize it that way. Do you burden a new hire with year old documents, PIR investigation reports, architecture documents that have drifted over years, information about systems that have become obsolete or telemetry logging that is long gone? The same hold true for an agent.</P> <P>An agent needs access to your systems. They need to know which problems <EM>they</EM> should be really solving. They need true context about how your service works. And they need to know when to act and when to check with someone first.</P> <P>If you get these things right, a fairly plain agent can do excellent work. Otherwise, you are just in a constant loop of updating prompts, changing tools, updating skills and getting frustrated. Everything below is a version of those four things.</P> <H2 id="1-connect-your-data-first">1. Connect your data first</H2> <P>You might have heard this phrase before - "Context is the King". Before writing a skill or an agent prompt, "empower" your agent first: your telemetry logs (most important), your incident system, your work tracking, your repositories. Agent without the right data is never going to succeed no matter how good prompt or skill is. Connect the "right" connectors and not "many" connectors.</P> <H4 id="these-are-important-so-do-these">These are important so "do" these</H4> <UL> <LI><STRONG>Connect telemetry and work tracking first</STRONG> — These help with most of the real investigative work.</LI> <LI><STRONG>Add deployment history and service health next</STRONG> — this is what links a problem to the change that caused it.</LI> <LI><STRONG>Index the systems where work already happens</STRONG> — your wiki and work items get used heavily; a separate document store barely gets touched.</LI> <LI><STRONG>Connect Teams or email for delivery</STRONG> — findings should land where your team already works.</LI> <LI><STRONG>Check connections are healthy, not just configured</STRONG> — a dead connector fails silently and takes your scheduled runs with it.</LI> </UL> <H4 id="avoid-doing-these">Avoid doing these</H4> <UL> <LI><STRONG>Don't connect a system until you need it</STRONG> — extra connections rarely get used, and you still have to keep them working.</LI> <LI><STRONG>Don't treat Teams or email as investigation tools</STRONG> — they carry a fraction of the traffic because they're output, not input.</LI> <LI><STRONG>Don't treat past incidents as the answer</STRONG> — use them as a starting point, then confirm with current data.</LI> <LI><STRONG>Don't add connections to fix a struggling agent</STRONG> — the best and worst agents we studied had nearly identical, fully healthy connection sets. One scored 4.9, the other 2.3. The difference was routing.</LI> </UL> <BLOCKQUOTE> <P>Never let the agent decide the source of truth. Feed it!</P> </BLOCKQUOTE> <H2 id="2-start-with-the-problem-that-annoys-you-most">2. Start with the problem that annoys you most</H2> <P>This goes back to the same new hire principal. Don't try to teach the agent your whole system. Pick an important component that wakes people up, or the investigation everyone dreads because it takes four hours and always ends the same way.</P> <P>Work that one scenario with the agent, interactively. The best to do is to "chat" with the agent without writing a new custom agent. Let it dig, correct it when it goes the wrong way, point it at the data it didn't knew about. When you and and the agent solve the issue together, ask the agent to turn what just happened into a skill or a custom agent. This approach is way more effective that perfecting the "correct" agent by starting with a lengthy prompt.</P> <P>Once you perfected one problem, move on to the next one.</P> <P>Each scenario is small, so it's quick to get right, and the context compounds. After a few weeks, you'll notice that the agent is helping with things you never "explicitly" taught it. It <EM>just</EM> learns (just like a good new hire).</P> <H2 id="3-send-the-right-incidents-to-the-right-specialist">3. Send the right incidents to the right specialist</H2> <P><EM>If you read only one section, read this one. Sending an agent the wrong work was one of the clearest problems we found.</EM></P> <P>A response plan decides which incidents reach an agent. If the plan accepts every incident but sends them all to a specialist built for one problem, many incidents will arrive without the information that specialist needs. It stops without helping, and the incident is marked unresolved. The agent may look broken, but it was given work it wasn’t built to do.</P> <P>We saw this with an agent that handled scheduled work well, scoring <STRONG>4.5 out of 5</STRONG>, but scored <STRONG>1.7 out of 5</STRONG> on incidents it received through a broad response plan. Another agent used <STRONG>71 response plans</STRONG>, each directing a specific kind of incident to the right specialist. It scored <STRONG>4.5 out of 5</STRONG> on incidents, with fewer than 1% failing. These are examples from different agents, not a before-and-after test, but they show why it’s worth checking how incidents are routed.</P> <P><STRONG>We recommend using response plans that match specific incidents to specialists that can handle them.</STRONG> Having many focused plans is fine; sending every incident through one broad plan to a narrow specialist is the problem.</P> <H2 id="4-write-a-few-skills-that-really-teach-something">4. Write a few skills that really teach something</H2> <P><EM>The number of skills an agent has matters less than what those skills teach it.</EM></P> <P>In our study, some agents with no skills performed better than agents with several. The strongest results were associated with skills that gave clear, detailed guidance, while agents with vague or empty skill descriptions struggled. One agent had three skills with no descriptions at all. That doesn’t prove that writing more will improve results, but it does show why adding skills just to increase the count isn’t useful.</P> <P>Think of a skill as a briefing for a colleague - It should explain <STRONG>which question it answers</STRONG>, the words people might use when asking it, how to decide what to do, and when the skill does <STRONG>not</STRONG> apply. It should also warn about mistakes that are easy to make. We recommend writing a skill when you have specific knowledge or judgment to teach the agent. Make it detailed enough to guide a real decision, rather than adding a short description that only names a topic.</P> <P>Here are three examples of how to turn a vague skill description into guidance the agent can actually use. These are <STRONG>illustrative examples</STRONG>, not descriptions taken from the study.</P> <P><STRONG>Billing issue</STRONG></P> <UL> <LI><STRONG>Too vague:</STRONG> “Helps with billing problems.”</LI> <LI><STRONG>Useful:</STRONG> “Use this when someone asks whether an order was charged, whether a missing charge will appear later, or how to recover a failed charge. Check the order and billing records before deciding. Don’t suggest creating a new billing record until you’ve ruled out an existing or delayed charge.”</LI> </UL> <P><STRONG>Deployment failure</STRONG></P> <UL> <LI><STRONG>Too vague:</STRONG> “Investigates failed deployments.”</LI> <LI><STRONG>Useful:</STRONG> “Use this when a deployment has failed or stopped making progress. Check its status, the failed step, and recent changes. Don’t recommend retrying until you know whether the previous attempt is still running or left work unfinished.”</LI> </UL> <P><STRONG>High error rate</STRONG></P> <UL> <LI><STRONG>Too vague:</STRONG> “Handles service alerts.”</LI> <LI><STRONG>Useful:</STRONG> “Use this when a service’s error rate rises. Check when the increase started, which requests are failing, and whether a deployment or dependency changed around the same time. Don’t blame the most recent deployment without evidence that it affected the failing requests.”</LI> </UL> <P>The useful versions tell the agent <STRONG>when to use the skill, what to check, and which mistake to avoid</STRONG>.</P> <H2 id="5-add-custom-agents-when-different-problems-need-different-help">5. Add custom agents when different problems need different help</H2> <P>A custom agent has its own instructions, tools, and scope for a particular kind of work. Create one when a problem comes up often enough to need a clear owner—not just because the option is available.</P> <P>For example, a <STRONG>deployment custom agent</STRONG> could check rollout status, failed steps, and recent changes when an alert follows a release. A <STRONG>billing custom agent</STRONG> could check order and charge records, with instructions to avoid actions that might charge a customer twice. These jobs need different evidence and different safeguards. An occasional question doesn’t necessarily need its own custom agent.</P> <P>In our study, agents with one or two custom agents performed much like agents with none; agents with three or more tended to do better. That’s an observation, <STRONG>not a target number</STRONG>. Add them as distinct, recurring problems emerge.</P> <P><STRONG>Be clear about when each custom agent runs.</STRONG> As the <A href="https://techcommunity.microsoft.com/blog/appsonazureblog/zero-ops-agents-operate-humans-govern/4545151" target="_blank">Zero Ops guidance</A> explains, you can call one directly in chat or select it through a response plan or scheduled task. This lets you send a deployment alert to the deployment custom agent without sending every incident there.</P> <P><STRONG>Limit access to what the job needs.</STRONG> Start with read access for investigation, and grant permission to make changes only where needed, with appropriate approval. Give each custom agent an explicit list of tools: for a custom agent, an empty tool list means default tool access, <EM>not</EM> “no tools.” The agent’s identity and permissions still set the outer boundary; a custom agent’s instructions alone are not a security control.</P> <H2 id="6-decide-how-much-freedom-to-give-scenario-by-scenario">6. Decide how much freedom to give, scenario by scenario</H2> <P><EM>Review mode protects you by asking a person to approve actions. Use it where approval matters, but remember that work can sit unfinished while it waits.</EM></P> <P>We saw this in two agents handling busy incident queues. Both followed their instructions well and rarely failed. One ran in review mode: <STRONG>96% of its incident work was waiting for approval</STRONG>, and its overall score was <STRONG>3.0 out of 5</STRONG>. The other worked autonomously and scored <STRONG>4.8 out of 5</STRONG>. These are different agents, so the scores don’t prove that changing the mode alone would close the gap. They do show why it’s worth checking how much work is waiting.</P> <P><STRONG>Choose the level of approval for each kind of work.</STRONG> For example:</P> <UL> <LI><STRONG>Investigating an alert:</STRONG> Let the agent read logs, check service health, and compare the alert with recent deployments without asking for approval at every step.</LI> <LI><STRONG>Sharing findings:</STRONG> If your team is comfortable with it, let the agent post an investigation summary to the incident. If posts need review, let it prepare a draft instead.</LI> <LI><STRONG>Restarting a service:</STRONG> Have the agent explain what it found and ask a person to approve the restart.</LI> <LI><STRONG>Changing a database or network setting:</STRONG> Keep a person involved. These changes can affect more than the incident the agent is investigating.</LI> </UL> <P>The goal isn’t to make the whole agent autonomous or put everything in review mode. <STRONG>Let routine investigation move forward, and require approval where the consequences of a mistake are greater.</STRONG></P> <H2 id="7-check-the-agent-can-finish-the-job">7. Check the agent can finish the job</H2> <P><EM>An agent can do a good investigation and still fail at the last step.</EM></P> <P>We saw several examples where an agent did useful work but couldn't complete the final step:</P> <UL> <LI>One agent found three incidents that needed action, but the incident-management write tools it needed were unavailable. It could explain what to do, but couldn't complete its scheduled task.</LI> <LI>Another investigated an incident and found the right team to take over, but the transfer failed with an authorization error. The incident stayed unresolved.</LI> <LI>A third gathered evidence for an incident, but couldn't save a lasting update because it lacked permission to write back to the incident system.</LI> </UL> <P>These can look like investigation failures when the actual blocker is access. That doesn't mean granting every agent write permission: decide which final steps it should perform, give it only the access those steps require, and make the human handoff clear for anything it shouldn't do itself.</P> <P>Before sending an agent to a live incident queue, try one example from start to finish. Check not only that it can find the answer, but that it can deliver the result in the way your team expects.</P> <HR /> <H3 id="troubleshooting-when-something-isnt-working-find-out-why">Troubleshooting: When something isn't working, find out why</H3> <P>Different problems can look alike. Check what happened before changing the agent's instructions.</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table><thead><tr><th>What you see</th><th>What to check first</th></tr></thead><tbody><tr><td>An investigation stops quickly without using tools</td><td>Did the response plan send it to the wrong custom agent?</td></tr><tr><td>The agent does a lot of work but misses the task</td><td>Does it need clearer instructions or a smaller task?</td></tr><tr><td>Work is accurate but waiting for approval</td><td>Is review mode stopping routine steps?</td></tr><tr><td>The same error keeps appearing</td><td>Is a connector broken, or is a permission missing?</td></tr></tbody></table></DIV> <P>Two questions are especially useful: <STRONG>Did the agent use the tools it needed?</STRONG> And <STRONG>do failures look the same each time?</STRONG> No tool use during an investigation may point to a routing problem. Repeated identical errors may point to a broken connection or missing permission. If the mistakes vary, look more closely at the instructions, skills, and information the agent received. These are clues, not diagnoses on their own.</P> <H3 id="if-you-already-have-an-agent-thats-struggling">If you already have an agent that's struggling</H3> <P>Check the basics before rewriting its skills:</P> <OL> <LI><STRONG>Check routing.</STRONG> Are unrelated incidents reaching a custom agent built for a narrower problem?</LI> <LI><STRONG>Check connections.</STRONG> Can the agent actually reach the systems it needs?</LI> <LI><STRONG>Check what is waiting.</STRONG> Is review mode holding up work that could safely continue?</LI> <LI><STRONG>Check the last step.</STRONG> Can the agent post its findings or complete an approved action?</LI> <LI><STRONG>Then review its guidance.</STRONG> If the agent has the right work, access, and permissions but still makes different mistakes, improve its instructions or skills.</LI> </OL> <HR /> <H2 id="how-we-know-this">How we know this</H2> <P>We studied production SRE Agent activity. We set aside test and demo agents, looked at agents doing real scheduled work, incident response, and chat, and compared their results with how they were configured.</P> <P>The examples show <STRONG>patterns we observed</STRONG>, not before-and-after tests. An agent scoring differently on incidents and scheduled work is a useful clue, but it does not prove that routing was the only cause. Scores can also change when the evaluation changes, so use the numbers as context rather than promises of what a configuration change will achieve.</P> <P><STRONG>Read scores in context.</STRONG> Compare incidents with incidents and scheduled tasks with scheduled tasks: open-ended chat often scores lower than work with a clear goal. Greetings aren't investigations, so don't use their scores to judge incident performance. And if an agent is marked down for a wordy answer, check whether its findings were useful before treating it as a failure.</P> <P>This is a starting point for teams to review and improve and we really hope this helps!</P> Thu, 24 Sep 2026 20:24:01 GMT https://techcommunity.microsoft.com/t5/apps-on-azure-blog/getting-the-best-out-of-azure-sre-agent/ba-p/4559745 puneetguptams 2026-09-24T20:24:01Z https://techcommunity.microsoft.com/t5/azure-tools-blog/introducing-bicep-docs-generate-documentation-from-your-bicep/ba-p/4559737 <P><STRONG>TL;DR:</STRONG> The Bicep CLI has a new experimental command, <CODE>bicep docs generate</CODE>. Point it at a Bicep module and it writes a <CODE>README.md</CODE> next to it that describes the module's resources, parameters, types, outputs and usage examples, all read straight from your code. You can change the layout with your own templates, add details that aren't in the code, and document every module in a repository with one command. It's available now in Bicep CLI v0.47.16 and later.</P> <LI-CODE lang="powershell">bicep docs generate ./main.bicep</LI-CODE> <H2>Why we built it</H2> <P>Module documentation has a habit of drifting away from the code it describes. Someone renames a parameter, adds an output or changes an allowed value, and the README quietly goes out of date. Teams that publish a lot of modules often end up writing their own scripts to keep the two in step.</P> <P><CODE>bicep docs</CODE> moves that job into the Bicep CLI. It compiles your module and uses the compiler's own understanding of it, so it picks up the details Bicep already knows: <CODE>metadata</CODE>, <CODE>@description</CODE> decorators, default values, allowed values, length limits, user-defined types, exported types, variables and functions, outputs, and the local modules it references. Run it again whenever the module changes, and the documentation will match the code.</P> <H2>Get started</H2> <P>You need Bicep CLI v0.47.16 or later. Check your version with <CODE>bicep --version</CODE>, and see <A href="https://learn.microsoft.com/azure/azure-resource-manager/bicep/install" target="_blank">Install Bicep tools</A> if you need to upgrade. There's no feature flag to turn on.</P> <P>Here's a small storage account module:</P> <LI-CODE lang="bicep">metadata name = 'Storage Account' metadata description = 'Deploys a storage account with secure defaults.' @description('Required. The name of the storage account. Must be globally unique.') @minLength(3) @maxLength(24) param name string @description('Optional. The Azure region to deploy the storage account to.') param location string = resourceGroup().location @description('Optional. The storage account SKU.') @allowed([ 'Standard_LRS' 'Standard_GRS' 'Standard_ZRS' ]) param skuName string = 'Standard_LRS' resource storageAccount 'Microsoft.Storage/storageAccounts@2025-06-01' = { name: name location: location kind: 'StorageV2' sku: { name: skuName } properties: { allowBlobPublicAccess: false minimumTlsVersion: 'TLS1_2' } } @description('The resource ID of the storage account.') output resourceId string = storageAccount.id</LI-CODE> <P>Generate its documentation:</P> <LI-CODE lang="powershell">bicep docs generate ./modules/storage-account/main.bicep</LI-CODE> <P>Bicep writes <CODE>README.md</CODE> next to <CODE>main.bicep</CODE>. For this module, the built-in layout includes a list of sections, the resource types, a usage example (more on those below), the parameters with the details of each one, and the outputs. When a module has them, it also covers exported types, variables and functions, and referenced modules. Here's an excerpt:</P> <LI-CODE lang="markdown"># Storage Account Deploys a storage account with secure defaults. ## Parameters | Name | Type | Required | Description | | :-- | :-- | :-- | :-- | | `location` | `string` | No | Optional. The Azure region to deploy the storage account to. | | `name` | `string` | Yes | Required. The name of the storage account. Must be globally unique. | | `skuName` | `string` | No | Optional. The storage account SKU. | ### `location` - Default value: `resourceGroup().location` ### `name` - Min length: 3 - Max length: 24 ### `skuName` - Default value: `'Standard_LRS'` - Allowed values: `Standard_GRS`, `Standard_LRS`, `Standard_ZRS`</LI-CODE> <P>A couple of options you'll use often:</P> <UL> <LI><CODE>--stdout</CODE> prints the result to the terminal instead of writing a file, which is handy for a quick preview.</LI> <LI><CODE>--outfile</CODE> writes to a file of your choice, and <CODE>--outdir</CODE> writes the documentation into another folder.</LI> </UL> <P>Because the command is experimental, Bicep prints a warning each time you run it.</P> <H2>Usage examples are included automatically</H2> <P>Examples are often the most useful part of module documentation, so <CODE>bicep docs</CODE> looks for them next to your module. By default it picks up:</P> <UL> <LI><CODE>.bicep</CODE> files in an <CODE>examples</CODE> folder, and <CODE>main.bicep</CODE> files in its subfolders</LI> <LI><CODE>*.test.bicep</CODE> files anywhere under a <CODE>tests</CODE> folder</LI> </UL> <P>Files named <CODE>dependencies*.bicep</CODE> are skipped. Each example's heading comes from its <CODE>metadata name</CODE>. Without one, Bicep uses the name of the folder the example is in, or its file name if it's not in a subfolder. The description comes from <CODE>metadata description</CODE>, or else the <CODE>//</CODE> comments at the top of the file. For example, this file in <CODE>modules/storage-account/examples</CODE> becomes a "Zone-redundant storage account" example in the README:</P> <LI-CODE lang="bicep">metadata name = 'Zone-redundant storage account' metadata description = 'Deploys a storage account that keeps copies of your data in three availability zones.' module storageAccount '../main.bicep' = { params: { name: 'stdocsdemo001' skuName: 'Standard_ZRS' } }</LI-CODE> <P>If your examples live somewhere else, list their locations in <CODE>documentation.examples.sources</CODE> in <CODE>bicepconfig.json</CODE>. Your list replaces the default locations.</P> <H2>Make it your own with templates</H2> <P>The built-in layout is a good start, but you'll probably have your own conventions. <CODE>bicep docs</CODE> renders documentation with <A href="https://github.com/scriban/scriban" target="_blank">Scriban</A>, a lightweight text templating language. Write a template, then point to it from <CODE>bicepconfig.json</CODE>:</P> <LI-CODE lang="json">{ "documentation": { "template": { "file": "templates/readme.scriban" } } }</LI-CODE> <P>The template path is relative to the <CODE>bicepconfig.json</CODE> file. As with its other settings, Bicep uses the <CODE>bicepconfig.json</CODE> nearest to each module.</P> <P>This template writes a parameters table and an outputs table:</P> <LI-CODE lang=""># {{ module.name }} {{ module.description }} ## Parameters | Name | Type | Required | Description | | :-- | :-- | :-- | :-- | {{~ for parameter in module.parameters ~}} | `{{ parameter.name }}` | `{{ parameter.type }}` | {{ if parameter.required }}Yes{{ else }}No{{ end }} | {{ parameter.description }} | {{~ end ~}} ## Outputs | Name | Type | Description | | :-- | :-- | :-- | {{~ for output in module.outputs ~}} | `{{ output.name }}` | `{{ output.type }}` | {{ output.description }} | {{~ end ~}}</LI-CODE> <P>The <CODE>~</CODE> inside the braces removes the spaces and line breaks next to a tag, so the loops don't add blank lines that would break the tables. Your template receives a <CODE>module</CODE> object with the module's <CODE>name</CODE>, <CODE>description</CODE>, <CODE>targetScope</CODE>, <CODE>resourceTypes</CODE>, <CODE>parameters</CODE>, <CODE>exportedTypes</CODE>, <CODE>exportedVariables</CODE>, <CODE>exportedFunctions</CODE>, <CODE>outputs</CODE>, <CODE>references</CODE> and <CODE>usageExamples</CODE>. The <A href="https://github.com/Azure/bicep/blob/main/docs/experimental/docs-commands.md#template-model" target="_blank">command documentation</A> lists every field.</P> <P>A couple of tips:</P> <UL> <LI>Split a big template into smaller files with Scriban's <CODE>include</CODE>, and set <CODE>documentation.template.includeRoot</CODE> to the folder that holds them.</LI> <LI>The <A href="https://github.com/Azure/bicep/blob/main/src/Bicep.Core/Documentation/Templates/Markdown.scriban" target="_blank">built-in Markdown template</A> is a Scriban template too, so it's a good place to start.</LI> </UL> <H2>Add details that aren't in your code</H2> <P>Some information doesn't belong in Bicep, such as the team that owns a module, where to get support, or the module's version. Pass it in as custom values and use them in your template as <CODE>custom.&lt;key&gt;</CODE>:</P> <LI-CODE lang="">**Owner:** {{ custom.owner }} | **Version:** {{ custom.version }} | [Get support]({{ custom.supportUrl }})</LI-CODE> <P>Supply values one at a time with <CODE>--custom-template-value</CODE>, or load several from a JSON file with <CODE>--custom-template-value-file-path</CODE>:</P> <LI-CODE lang="powershell">bicep docs generate ./modules/storage-account/main.bicep ` --custom-template-value owner="Platform Team" ` --custom-template-value-file-path ./docs-values.json</LI-CODE> <P>Where <CODE>docs-values.json</CODE> contains:</P> <LI-CODE lang="json">{ "supportUrl": "https://contoso.example/support", "version": "1.0.0" }</LI-CODE> <P>Both options can be repeated. If the same key is set more than once, the last one on the command line wins.</P> <H2>Go beyond Markdown</H2> <P>Scriban writes whatever text your template contains, so the output doesn't have to be Markdown. A template could produce JSON for a module catalogue, HTML for an internal portal, or input for another tool. This template produces JSON, and Scriban's <CODE>object.to_json</CODE> function takes care of quotes and escaping:</P> <LI-CODE lang="">{ "name": {{ module.name | object.to_json }}, "description": {{ module.description | object.to_json }}, "parameters": [ {{~ for parameter in module.parameters ~}} { "name": {{ parameter.name | object.to_json }}, "type": {{ parameter.type | object.to_json }}, "required": {{ parameter.required | object.to_json }} }{{ if !for.last }},{{ end }} {{~ end ~}} ] }</LI-CODE> <P>Set <CODE>documentation.template.file</CODE> to this template, then use <CODE>--outfile</CODE> to save the result with a <CODE>.json</CODE> file name:</P> <LI-CODE lang="powershell">bicep docs generate ./modules/storage-account/main.bicep --outfile ./modules/storage-account/module.json</LI-CODE> <P>To change the default file name for every module instead, set <CODE>documentation.output.file</CODE> in <CODE>bicepconfig.json</CODE>.</P> <P>Each module uses the one template set in its nearest <CODE>bicepconfig.json</CODE>. To get both Markdown and JSON from the same modules, make that template a small switch that includes the right template based on a custom value:</P> <LI-CODE lang="">{{~ if custom.format == "json" ~}} {{~ include "catalog.scriban" ~}} {{~ else ~}} {{~ include "readme.scriban" ~}} {{~ end ~}}</LI-CODE> <P>Set <CODE>documentation.template.includeRoot</CODE> to the folder that holds the templates. Then run the command as normal for the README, and add <CODE>--custom-template-value format=json --outfile ./modules/storage-account/module.json</CODE> for the JSON.</P> <H2>Document every module in one go</H2> <P>Use <CODE>--pattern</CODE> to document every module that matches a wildcard:</P> <LI-CODE lang="powershell">bicep docs generate --pattern './modules/**/main.bicep'</LI-CODE> <P>Each module gets its own <CODE>README.md</CODE> next to its <CODE>main.bicep</CODE>. Add <CODE>--outdir ./docs</CODE> to put them in a separate folder instead, and Bicep recreates the folder structure beneath it. If a module has compile errors, Bicep reports them, carries on documenting the other modules, and returns exit code 1 at the end.</P> <P>To see this at scale, the <A href="https://aka.ms/bicep/docs/demo" target="_blank">demo repository</A> generates <A href="https://aka.ms/avm" target="_blank">Azure Verified Modules</A> (AVM) style documentation for 20 App Service modules, including their child modules, with a single command. Its template works out each module's registry reference and main resource type from the module itself. The AVM team is standardising and consolidating its tooling, and <CODE>bicep docs</CODE> is part of that work.</P> <H2>Keep documentation up to date in CI</H2> <P>Because the documentation comes from the code, your pipeline can check that it's current. Regenerate it, then fail the build if anything changed:</P> <LI-CODE lang="powershell">bicep docs generate --pattern './modules/**/main.bicep' if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } $changes = git status --porcelain if ($changes) { $changes throw 'Module documentation is out of date. Run bicep docs generate and commit the result.' }</LI-CODE> <P>The generated documentation is only as good as your descriptions, so the new description linter rules in Bicep v0.47 make a good partner. They're off by default and flag missing or empty <CODE>@description</CODE> decorators. Turn on the ones you need in <CODE>bicepconfig.json</CODE>:</P> <LI-CODE lang="json">{ "analyzers": { "core": { "rules": { "use-description-params": { "level": "warning" }, "use-description-outputs": { "level": "warning" }, "use-description-types": { "level": "warning" }, "use-description-type-properties": { "level": "warning" } } } } }</LI-CODE> <P>There's also <CODE>use-description-vars</CODE> for variables. Thanks to <A href="https://github.com/johnlokerse" target="_blank">@johnlokerse</A> for contributing these rules!</P> <H2>Building tools on top of Bicep?</H2> <P>The same generator is available through the Bicep CLI's JSON-RPC interface as <CODE>bicep/generateDocs</CODE>. It returns the rendered text and leaves writing files to you. For .NET, the <A href="https://www.nuget.org/packages/Azure.Bicep.RpcClient" target="_blank">Azure.Bicep.RpcClient</A> package wraps it.</P> <H2>It's experimental, and we'd love your feedback</H2> <P><CODE>bicep docs</CODE> is experimental. The command options, configuration, template model and built-in layout may change between releases without a breaking-change notice.</P> <P>One change is already on the way. In v0.47 you can also choose a template with the <CODE>--template-file</CODE> and <CODE>--template-root</CODE> options. The next release removes these options, so templates are set only with <CODE>documentation.template.file</CODE> and <CODE>documentation.template.includeRoot</CODE> in <CODE>bicepconfig.json</CODE>. The examples in this post already use <CODE>bicepconfig.json</CODE>, so they'll keep working.</P> <P>Try it on your own modules and tell us what works and what's missing by <A href="https://github.com/Azure/bicep/issues" target="_blank">opening an issue</A> in the Bicep repository.</P> <H2>Learn more</H2> <UL> <LI><A href="https://github.com/Azure/bicep/blob/main/docs/experimental/docs-commands.md" target="_blank">bicep docs command documentation</A></LI> <LI><A href="https://aka.ms/bicep/docs/demo" target="_blank">Demo repository</A>, with step-by-step demos from the built-in layout to AVM-style documentation</LI> <LI><A href="https://github.com/Azure/bicep/releases/tag/v0.47.16" target="_blank">Bicep v0.47.16 release notes</A></LI> <LI><A href="https://scriban.github.io/docs/language/" target="_blank">Scriban language reference</A></LI> <LI><CODE>bicep docs</CODE> is also featured in the September 2026 Bicep community call. Community call recordings are on the <A href="https://www.youtube.com/channel/UCZZ3-oMrVI5ssheMzaWC4uQ/videos" target="_blank">Azure Deployments &amp; Governance YouTube channel</A>, and you can <A href="https://aka.ms/armnews" target="_blank">sign up</A> to join future calls.</LI> </UL> Thu, 24 Sep 2026 19:55:33 GMT https://techcommunity.microsoft.com/t5/azure-tools-blog/introducing-bicep-docs-generate-documentation-from-your-bicep/ba-p/4559737 jaredfholgate 2026-09-24T19:55:33Z https://techcommunity.microsoft.com/t5/telecommunications-media/ibc-reflections-and-where-media-is-headed/ba-p/4559411 <P>Over the last several years, it has been easy to focus on the magical experiences produced with AI-generated content. The media industry has responded with growing short-form video, IP licensing for quality AI generated content, and various other approaches, but the core end-to-end workflows and structures of the media industry are intact. In a recent global entertainment and media outlook, <A href="https://www.pwc.com/gx/en/issues/business-model-reinvention/outlook/insights-and-perspectives.html" target="_blank" rel="noopener">PwC forecasts that technology and live, immersive experiences will fuel global industry growth to $4.2T by 2030</A>.</P> <P>New technology imperatives, especially AI, are redefining not just how content is created, but also how it is produced, distributed, and monetized. Following this logic,<STRONG> </STRONG>it is reasonable to expect that <STRONG>the </STRONG><STRONG>future of the media and entertainment industry will</STRONG><STRONG> not be defined solely by</STRONG><STRONG> AI-</STRONG><STRONG>generated content, but by</STRONG><STRONG> AI-</STRONG><STRONG>orchestrated media operations</STRONG>.</P> <P>This was top of mind for customers and partners during <A href="https://show.ibc.org/" target="_blank" rel="noopener">IBC 2026.</A> While strategies appear to vary across the media landscape, there is growing consistency in how the Media Industry is assessing, trialing, deploying, and industrializing AI solutions, regardless of whether the focus is on content production (broadcast, streaming), agencies, or data analytics and marketing firms. Social media and shifting consumer engagement patterns are exerting significant pressure on the media industry, forcing organizations to accelerate transformation efforts focused on both operational efficiency and revenue growth.</P> <P>However, there are five emerging strategic themes emerging, tied closely to growth, yield, margins, IP returns, advertising outcomes, and trust:</P> <OL> <LI>Increase the return on premium content and IP</LI> <LI>Industrialize creative and content production</LI> <LI>Unify fragmented workflows, data, and decision-making</LI> <LI>Make audience engagement and monetization real-time and measurable</LI> <LI>Create an AI operating model with trust, rights, governance, and economics built in</LI> </OL> <P>In simple terms, the industry focus on accelerating content creation and production, running and distributing media operations at-scale, and transforming insights into personalized engagement and monetization highlight the need for a <A href="https://www.microsoft.com/en-us/ai/media-entertainment" target="_blank" rel="noopener">Connected Media Platform</A> foundation. There are many clear examples where this is already happening:</P> <UL> <LI>The&nbsp;<A href="https://news.microsoft.com/source/2025/07/01/premier-league-and-microsoft-announce-five-year-strategic-partnership-to-personalize-the-fan-experience-with-ai-for-1-8-billion-people/" target="_blank" rel="noopener">English Premier League Companion</A> draws on 30 seasons of statistics and supports experiences for 1.8B fans across 189 countries.</LI> <LI>The&nbsp;<A href="https://www.microsoft.com/en/customers/story/25537-wnet-azure-virtual-desktop" target="_blank" rel="noopener">WNET Group</A> moved 3.6B PB of data (800,000 content hours) to Microsoft Azure, creating the foundation for ongoing management, preservation, and monetization through cloud-first workflows while taking asset recovery from 24 hours to 4 hours.</LI> <LI><A href="https://www.microsoft.com/en/customers/story/1646266241611394912-project-gutenberg-nonprofit-azure-synapse-analytics-azure-ai-services" target="_blank" rel="noopener">Gutenberg</A> has produced nearly 5,000 audiobooks with AI.</LI> <LI><A href="https://www.microsoft.com/en/customers/story/19582-dentsu-azure-kubernetes-service" target="_blank" rel="noopener">Dentsu</A> has seen a 90% reduction in time-to-insight for media planning analytics.</LI> <LI><A href="https://www.microsoft.com/en/customers/story/20025-mk-systems-usa-azure" target="_blank" rel="noopener">MediaKind</A>, Azure-first platform modernization for scalable secure video delivery, is leveraging dynamic dubbing and video captioning to create opportunities with new audiences in minutes.</LI> </UL> <P>Similar to other industries, AI is not just perceived as an opportunity, but as a structural capability across the media industry. The future media production platform is a governed, event-driven portfolio of specialized agents operating over a shared media knowledge plane, coordinating people, models, and tools from greenlight through monetization, with every outcome feeding the next creative and commercial decision in parallel.</P> <P>Like most operational shifts, this is likely to occur in phases. Today, Phase 1, media production consists of specialized knowledge workers and teams operating highly capable tools chained together into production workflows. The production workflows are sequential with manual handoffs. Each of the stages within the production workflow are increasingly digital, and many of the tools have AI capabilities, but the lifecycle does not operate as one continuous system.</P> <P>Phase 2 brings a human-AI hybrid operating model in vertical silos (ex. Development and Greenlight intelligence, Production planning and Finance, Audience feedback into creative optimization), where connected workflows are coordinated between people and agents. What makes this a phase rather than a collection of pilots is the shared media knowledge layer underneath. Agents in different domains read from and write to the same understanding of content, rights, audiences, and performance. The human role changes before the org chart does. People stop executing every step and start supervising: reviewing agent recommendations, handling exceptions, and making the calls that carry creative or financial risk. Coordination still happens across existing systems rather than replacing them, which is why this phase is achievable without a platform migration. The constraint in Phase 2 is rarely model capability. It is the quality of the shared knowledge layer and whether the governance model lets agents act on it.</P> <P>AI is starting to arrive in multiple layers of the media value chain.</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table class="lia-border-style-solid" border="1" style="width: 90.2778%; border-width: 1px;"><tbody><tr><td> <P><STRONG>Theme</STRONG></P> </td><td> <P><STRONG>AI Outcome</STRONG></P> </td></tr><tr><td> <P>Creative and Content Supply Workflows</P> </td><td> <P>AI-powered creation via an industrialized supply chain. The industry opportunity is a repeatable (Deterministic) system that moves an idea through planning, production, enrichment, localization, packaging, distribution, promotion and measurement.</P> </td></tr><tr><td> <P>Content and IP intelligence</P> </td><td> <P>Turn every asset into a governed, semantically understood, reusable and monetizable piece of IP. Indexing and retrieval are the technical foundations to enabling reusability of decades of content catalog.</P> </td></tr><tr><td> <P>Production Control Plane and orchestration</P> </td><td> <P>An orchestration layer connecting data, planning, activation, measurement, and monetization. This brings together specialized agents and agentic workflows connecting shared intelligence.</P> </td></tr><tr><td> <P>Data, metadata, knowledge and semantic layer</P> </td><td> <P>A media intelligence fabric as the foundational layer of execution. This is not just a metadata layer, but the intelligence layer for the orchestration layer.</P> <P>Every media company we met with at IBC is prioritizing some version of an intelligence substrate.</P> </td></tr><tr><td> <P>Real-time delivery, monitoring, and optimization</P> </td><td> <P>A system that observes live production / delivery / campaign, understands context, predicts opportunity (degradation, for example), recommends and executes an intervention, and measures the result.</P> <P>One global broadcaster was most-explicit about prioritizing in-flight performance, near-real-time intelligence, and smarter decisioning.</P> </td></tr><tr><td> <P>Real-time Content, Audience, and Monetization Intelligence</P> </td><td> <P>Personalization, directly connected to monetization, including audience engagement, content discovery, and ad yield.</P> <P>Archive and Live are sub-patterns that drive different requirements across delivery, content rights, and metadata.</P> </td></tr><tr><td> <P>Trust, rights, and governance</P> </td><td> <P>Governance can no longer be viewed as compliance overhead. It’s imperative to retain customer trust.</P> <P>&nbsp;<A href="https://www.accenture.com/us-en/insights/song/accenture-life-trends" target="_blank" rel="noopener">Accenture’s Life Trends</A> highlights that 52% of people have seen deepfake news in the past year; 33% have experienced deepfake attacks or scams targeting personal information.</P> </td></tr></tbody><colgroup><col style="width: 50.00%" /><col style="width: 50.00%" /></colgroup></table></DIV> <P>&nbsp;</P> <P>Phase 3 brings together human ambition and AI, where creative intent, production operations, audience intelligence, and commercial performance operate through a single intelligence layer. <A href="https://www.gartner.com/en/webinar/784381/1775526-gartner-agentic-compass-for-ai-success-aligning-innovation-with-enterprise-needs" target="_blank" rel="noopener">Gartner</A> expects a third of enterprise software to include agentic AI by 2028, and <A href="https://www.capgemini.com/news/press-releases/trust-and-human-ai-collaboration-set-to-define-the-next-era-of-agentic-ai-unlocking-450-billion-opportunity-by-2028/" target="_blank" rel="noopener">Capgemini</A> puts the economic value in play at $450B on the same timeline, with trust and human-AI collaboration as the gating factor rather than model capability.</P> <P>In media, workflows run through one intelligence layer spanning creative intent, production operations, audience intelligence, and commercial performance. Agents assemble their own context and replan continuously as conditions change, so a schedule slip, a rights expiry, and a shift in audience signal are handled as one connected event rather than three disconnected escalations. Creative and financial workflows stop running in sequence and start running in parallel. Audience signal feeds development rather than only post-mortems.</P> <P>Humans become creative directors of agent-assisted processes, evaluators of quality, and decisionmakers at high-stakes moments. They are able to establish a creative, commercial, or operational goal, and the agent assembles the context (script, asset, rights, budget, talent, schedule, audience, distribution commitments) then executes, continuously replanning as events trigger (i.e., rights change, budget change, re-shoots). The creative workflow and financial workflow progress in parallel. This is not a shift from human to agentic workflow execution. It is a shift in which humans and agents turn creative intent into outcomes.</P> <P>Content is no longer the finished output, but a reusable strategic asset that can be packaged, personalized, promoted, localized, licensed and merchandised through continuous experimentation.</P> <P>Customer experience becomes an input into the media production, with audience signals influencing development, content packaged and personalized with companion experiences, and engagement starting before release and continuing after release.</P> <P>Phase 3 is not a shift from human to agentic workflow execution. It’s a shift in which humans and agents turn creative intent into outcomes.</P> <P>None of this is a prediction about a distant future. Phase 2 is already in production. <A href="https://www.gartner.com/en/webinar/784381/1775526-gartner-agentic-compass-for-ai-success-aligning-innovation-with-enterprise-needs" target="_blank" rel="noopener">Gartner</A> expects a third of enterprise software to include agentic AI by 2028, and <A href="https://www.capgemini.com/news/press-releases/trust-and-human-ai-collaboration-set-to-define-the-next-era-of-agentic-ai-unlocking-450-billion-opportunity-by-2028/" target="_blank" rel="noopener">Capgemini</A> puts the economic value in play at $450B on the same timeline, with trust and human-AI collaboration as the gating factor rather than model capability. <A href="https://tei.forrester.com/go/microsoft/ai-for-media-and-entertainment/?lang=en-us" target="_blank" rel="noopener">Forrester's December 2025</A> modelling of a composite media and entertainment organization puts the return at 118% to 251% ROI, driven not by novel content generation but by time recaptured across content management, creation, localization, and distribution. The technology to run a connected media operation largely exists. What separates the companies that get there from the companies that don't is whether they build the shared knowledge layer and the governance model to act on it or keep buying point solutions that automate individual steps of a broken workflow. That is the choice in front of the industry, and 40% of media CEOs already suspect their current path does not survive the decade.</P> <P>We'll be going deeper on all of this at <A href="https://ignite.microsoft.com/en-US/home" target="_blank" rel="noopener">Microsoft Ignite, November 17-20, 2026</A> at Moscone Center in San Francisco, where you'll hear it from the media companies doing the work rather than from us. If you're building toward this, come and find us there.</P> Thu, 24 Sep 2026 19:00:00 GMT https://techcommunity.microsoft.com/t5/telecommunications-media/ibc-reflections-and-where-media-is-headed/ba-p/4559411 kshatzkamer 2026-09-24T19:00:00Z https://techcommunity.microsoft.com/t5/oracle-on-azure-blog/oracle-ai-database-azure-expands-with-azure-native-oracle/ba-p/4559430 <P><SPAN data-contrast="none">Customers running mission-critical <STRONG>Oracle </STRONG>workloads on <STRONG>Azure </STRONG>want more than database infrastructure in an Azure datacenter. They want their Oracle environments to fit naturally into the way their teams already build, govern, monitor, and purchase services on Azure.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">Today, <STRONG>Oracle AI Database@Azure</STRONG> takes another step in that direction with a native Azure experience for Oracle GoldenGate. Customers can provision and manage GoldenGate resources through the Azure portal and APIs, configure connections across databases, clouds, streaming platforms, and Microsoft Fabric, and bring GoldenGate metrics and operational logs into Azure Monitor and Azure Log Analytics.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">Together, these capabilities reduce the boundaries between Oracle data replication and the Azure applications, analytics services, operational tools, and governance processes that surround it.</SPAN></P> <H4 aria-level="1"><SPAN class="lia-text-color-15"><STRONG>Oracle GoldenGate as a native Azure experience&nbsp;</STRONG></SPAN></H4> <P><SPAN data-contrast="none">Oracle GoldenGate helps enterprises keep operational systems, analytics platforms, and AI workloads synchronized through real-time data replication. The native Azure experience brings GoldenGate provisioning, resource management, connectivity, automation, governance, and observability into the Oracle AI Database@Azure environment.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">Customers can create, list, pair, manage, and delete GoldenGate deployments and connections through the Azure portal and incorporate the same lifecycle operations into automated workflows through APIs. Resources are discoverable from the Oracle AI Database@Azure overview and through Microsoft Marketplace search. Because these objects participate in the Azure control plane, teams can apply familiar Azure capabilities such as role-based access control, tags, sizing choices, and Activity Log auditing across the GoldenGate lifecycle.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">Provisioning is handled through the Azure experience, while administrators can open the GoldenGate console for detailed replication configuration after deployment. This approach keeps resource deployment, ownership, automation, governance, and auditability in Azure while preserving the specialized GoldenGate experience for configuring replication processes.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <H5 aria-level="2"><SPAN class="lia-text-color-15">Connect Oracle data to the platforms where teams use it&nbsp;</SPAN></H5> <P><SPAN data-contrast="none">The native Azure experience also reflects the breadth of systems that GoldenGate can connect. Customers can configure connections for Oracle Database, Oracle Exadata, OCI Autonomous Database, and Amazon RDS for Oracle, along with Exadata and Autonomous Database services running across Azure, Google Cloud, and AWS.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">For streaming scenarios, supported connection options include Azure Event Hubs, Apache Kafka, Confluent Kafka, Microsoft Fabric Eventstream, and OCI Streaming. GoldenGate can also synchronize Oracle data with Microsoft Fabric destinations including Fabric Lakehouse and Fabric Mirror expediting</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}"> your ongoing journey of AI solutioning to build Data agents in Fabric more seamlessly.</SPAN></P> <P><SPAN data-contrast="none">These connection options make GoldenGate a practical bridge between operational Oracle data and the analytics, streaming, and AI services that depend on continuously updated information.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <H4 aria-level="1"><STRONG><SPAN class="lia-text-color-15">Observe GoldenGate with Azure Monitor and Log Analytics&nbsp;</SPAN></STRONG></H4> <P><SPAN data-contrast="none">Provisioning GoldenGate in Azure is only part of the operational experience. As replication environments grow, teams also need a consistent way to monitor service health, identify lag, and investigate operational changes alongside the rest of their Azure estate.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">Oracle GoldenGate deployment metrics and operational logs are now generally available in Azure Monitor and Azure Log Analytics for Oracle AI Database@Azure customers. Teams can monitor replication health, create alerts, analyze lifecycle events, and correlate GoldenGate telemetry with Azure applications and infrastructure using the Azure tools they already rely on.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <H5 aria-level="2"><SPAN class="lia-text-color-15">Metrics for health, resource use, lag, and process status&nbsp;</SPAN></H5> <P><SPAN data-contrast="none">Azure Monitor provides 18 GoldenGate metrics organized around three operational needs. Deployment health and resource metrics cover CPU, memory, OCPU consumption, file system usage, temporary space, swap space, and overall deployment health.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">Replication-lag metrics provide visibility across the deployment and its components, including inbound and outbound deployment lag, Extract and Replicat lag, distribution and receiver path lag, and heartbeat lag. Status metrics show the state of Extract, Replicat, distribution paths, and receiver paths.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">Teams can use these signals in Azure alerts, dashboards, workbooks, and queries, helping them spot replication delays or unavailable processes before those issues affect downstream applications and data consumers.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <H5 aria-level="2"><SPAN class="lia-text-color-15">Operational events in Azure Log Analytics&nbsp;</SPAN></H5> <P><SPAN data-contrast="none">GoldenGate lifecycle and operational events can also be sent to an Azure Log Analytics workspace through diagnostic settings. The release includes event categories for deployment updates, deletions, restore workflows, maintenance activity, critical service conditions, and informational state transitions.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">Bringing both metrics and operational events into Azure gives operations teams a more complete view. They can see when behavior changed, review the lifecycle or maintenance activity around that change, and correlate the result with signals from Azure applications and infrastructure.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <H4 aria-level="1"><SPAN class="lia-text-color-15"><STRONG>A more connected Oracle and Azure experience&nbsp;</STRONG></SPAN></H4> <P><SPAN data-contrast="none">The native GoldenGate experience brings provisioning, API-driven lifecycle management, connectivity, governance, metrics, and operational logs together as part of Oracle AI Database@Azure. Customers can manage replication resources through Azure, connect Oracle data to the services and platforms where teams use it, and incorporate GoldenGate telemetry into day-to-day Azure operations.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P><SPAN data-contrast="none">The result is less operational friction for customers building applications, data platforms, analytics, and AI solutions around Oracle databases on Azure. Oracle AI Database@Azure continues to evolve as an experience that is managed, governed, automated, and observed through the Azure tools customers already use.</SPAN><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <P aria-level="1"><SPAN data-contrast="none"><SPAN data-ccp-parastyle="heading 1">Learn more</SPAN></SPAN><SPAN data-ccp-props="{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;201341983&quot;:0,&quot;335559738&quot;:320,&quot;335559739&quot;:120,&quot;335559740&quot;:269}">&nbsp;</SPAN></P> <UL> <LI aria-setsize="-1" data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;singleLevel&quot;}" data-aria-posinset="1" data-aria-level="1"><A href="https://learn.microsoft.com/en-us/azure/oracle/oracle-db/oracle-database-get-started" target="_blank" rel="noopener"><SPAN data-contrast="none"><SPAN data-ccp-parastyle="List Bullet">Get started with Oracle AI Database@Azure</SPAN></SPAN></A><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></LI> </UL> <UL> <LI aria-setsize="-1" data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;singleLevel&quot;}" data-aria-posinset="2" data-aria-level="1"><A href="https://blogs.oracle.com/dataintegration/announcing-native-ui-for-oracle-goldengate-on-oracle-ai-databaseazure" target="_blank" rel="noopener"><SPAN data-contrast="none"><SPAN data-ccp-parastyle="List Bullet">Learn about the native Azure experience for Oracle GoldenGate</SPAN></SPAN></A><SPAN data-ccp-props="{&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:269}">&nbsp;</SPAN></LI> </UL> Thu, 24 Sep 2026 17:29:07 GMT https://techcommunity.microsoft.com/t5/oracle-on-azure-blog/oracle-ai-database-azure-expands-with-azure-native-oracle/ba-p/4559430 RajyaLaxmiYellajosyula 2026-09-24T17:29:07Z https://techcommunity.microsoft.com/t5/azure-integration-services-blog/migrate-data-ingestion-from-data-collector-to-log-ingestion-part/ba-p/4559649 <P>In <A class="lia-internal-link lia-internal-url lia-internal-url-content-type-blog" href="https://techcommunity.microsoft.com/blog/integrationsonazureblog/migrate-data-ingestion-from-data-collector-to-log-ingestion/4510493" data-lia-auto-title="Part1" data-lia-auto-title-active="0" target="_blank">Part1</A>, we discussed how to use HTTP action to migrate from the deprecated Data Collector API to Log Ingestion API.</P> <P>However, since the deprecated Data Collector API was allowing message payload up to 30MB, some migration scenarios encountered issues; since the new Log Ingestion API has only 1MB payload limit. This applies to both HTTP action, and the preview (Log Ingestion connector)</P> <P><A href="https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/service-limits#logs-ingestion-api" target="_blank">Azure Monitor service limits - Azure Monitor | Microsoft Learn</A></P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P class="lia-align-left">&nbsp;</P> <P class="lia-align-left">When sending payload larger than 1MB, the HTTP action would fail with the error:</P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>In order to overcome this, we can chunk the array payload, before calling the Ingestion API. We need to chunk the array payload, so each produced chunk is around 800KB</P> <P>To do this, you can divide the size of your full payload, by the number of records it has, and this would give an average record size. Then divide 800,000 bytes with the average record size, and this will give you the chunk size.</P> <P><BR />For example, if your payload size is 1,200,259 bytes, and the number of records is 2500, then the average record size is:<BR />1,200,259 / 2,500 =~ 480 bytes<BR /><BR />To find the chunk size, we divide 800,000 bytes by 480 bytes</P> <P>800,000 / 480 =~ 1666 records.<BR /><BR />So if we send around 1600 records, this should be less than 1MB.</P> <P>To chunk your array payload, we can use the chunk expression inside a compose action.</P> <img /> <P>You can use the expression below for chunking inside the compose action:</P> <img /> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>After the compose action, add for-each action, and use the output of the compose action as an input:</P> <img /> <P>Inside the for-each, use the normal HTTP to send the logs, and in the body, choose the for-each current item</P> <img /> <P>&nbsp;</P> Thu, 24 Sep 2026 15:05:05 GMT https://techcommunity.microsoft.com/t5/azure-integration-services-blog/migrate-data-ingestion-from-data-collector-to-log-ingestion-part/ba-p/4559649 mshboul 2026-09-24T15:05:05Z https://techcommunity.microsoft.com/t5/microsoft-developer-community/engineering-agentic-recall-controls-with-mcp-and-microsoft/ba-p/4557549 <ARTICLE> <P>AI agents become operationally interesting when they can reach real systems. They also become operationally dangerous at exactly the same moment.</P> <P>Caldova Recall Control Tower is a developer demonstration built around that tension. It uses a fictional pharmaceutical recall to show how an agent can gather evidence and prepare a decision while deterministic application code retains authority over approval and inventory mutation. The implementation combines the Model Context Protocol (MCP), Microsoft Agent Framework, a Microsoft Foundry Hosted Agent, FastAPI, Microsoft Entra authentication, managed identity, and optimistic concurrency in Azure Blob Storage.</P> <P><STRONG>Central design rule:</STRONG> Let the model interpret and recommend. Make ordinary code authenticate, authorize, mutate, and prove what happened.</P> <BLOCKQUOTE> <P>Caldova is fictional, all operational data is synthetic, and this sample is not a production recall system or a source of clinical advice.</P> </BLOCKQUOTE> <H2>The scenario: useful reasoning, consequential action</H2> <P>The demo starts with a temperature excursion affecting batch <CODE>B-2408-AX7</CODE> of Caldova Relief 20 mg tablets. The synthetic inventory contains 2,196 units across two distribution centers and two retail stores. A useful system must establish the notice, locate every affected position, check supplier status, explain uncertainty, and recommend an action.</P> <P>That analysis is a good fit for specialized agents. Quarantining inventory is not.</P> <P>Quarantine changes operational state. It therefore needs an authenticated human, explicit authorization, a batch-scoped approval, concurrency control, idempotency, and an audit record. None of those guarantees should depend on a prompt being followed.</P> </ARTICLE> <img /> <ARTICLE> <FIGURE> <FIGCAPTION>The authenticated hosted application at the start of the fictional recall.</FIGCAPTION> </FIGURE> <H2>Architecture: separate reasoning from authority</H2> <P>The solution has two related but deliberately separate paths.</P> <img /> <FIGURE> <FIGCAPTION>Caldova separates model reasoning from application authority. Official Microsoft service icons identify Foundry Agent Service, App Service, Managed Identity, and Blob Storage.</FIGCAPTION> </FIGURE> <P>The <STRONG>reasoning path</STRONG> invokes a Hosted Agent through the Responses protocol. Four agents run in a fixed sequence: triage, inventory impact, supplier/compliance, and supervisor. The first three have narrow read-only tools. The supervisor has no tools and synthesizes the accumulated context into a decision brief.</P> <P>The <STRONG>authority path</STRONG> remains in the web application. It validates the EasyAuth identity claims, checks an approver allowlist, binds approval to the caller, batch, action, and current demo generation, and only then calls deterministic domain code. State is stored per actor in Blob Storage and updated with ETag match conditions so concurrent writes fail instead of silently overwriting each other.</P> <P>There is also a deterministic localhost demo. It reuses synthetic domain fixtures and demonstrates MCP contracts, approval, quarantine, and replay without a model or cloud account. It is useful for development, but its typed approver name and in-memory state are not production identity or durable compliance evidence.</P> <H2>Building a narrow MCP surface</H2> <P>MCP standardizes how an AI application discovers and calls external tools. It does not remove the need to design those tools carefully.</P> <P>Caldova exposes small, typed operations such as <CODE>get_recall_notice</CODE>, <CODE>locate_inventory</CODE>, and <CODE>get_supplier_status</CODE>. Inputs are constrained with Pydantic, and tool annotations tell clients that these operations are read-only and closed-world:</P> <PRE class="language-python" tabindex="0" contenteditable="false" data-lia-code-value="@mcp.tool( title=&quot;Locate affected inventory&quot;, annotations=ToolAnnotations( read_only_hint=True, open_world_hint=False, ), ) def locate_inventory(batch_id: BatchId) -&gt; dict[str, Any]: return STORE.locate_inventory(batch_id)"><CODE>@mcp.tool( title="Locate affected inventory", annotations=ToolAnnotations( read_only_hint=True, open_world_hint=False, ), ) def locate_inventory(batch_id: BatchId) -&gt; dict[str, Any]: return STORE.locate_inventory(batch_id)</CODE></PRE> <P>The mutation tool is separately marked destructive and requires a batch-scoped approval token. Those annotations improve discovery and planning, but they are metadata, not an authorization boundary. The real check occurs inside <CODE>quarantine_batch</CODE>, below the model and below the tool description.</P> <P>The Hosted Agent does not receive the mutation tools at all. Its specialists call only three read operations through an isolated MCP stdio subprocess. This is stronger than asking an all-powerful agent to "please remain read-only": capability is constrained by construction.</P> <P>The subprocess boundary also keeps MCP v2 dependencies isolated from the Foundry hosting environment. Each call has a timeout, bounded concurrency, structured JSON handling, and a generic failure response that does not leak subprocess details.</P> <H2>Fixed workflows beat vague autonomy for this case</H2> <P>Multi-agent does not have to mean dynamic routing. Caldova uses an explicit sequence because the business dependency is explicit: validate the notice before locating inventory, locate inventory before checking supplier implications, and synthesize only after all three specialist outputs exist.</P> <PRE class="language-python" tabindex="0" contenteditable="false" data-lia-code-value="return ( WorkflowBuilder(start_executor=triage, output_from=[supervisor]) .add_edge(triage, inventory) .add_edge(inventory, compliance) .add_edge(compliance, supervisor) .build() .as_agent() )"><CODE>return ( WorkflowBuilder(start_executor=triage, output_from=[supervisor]) .add_edge(triage, inventory) .add_edge(inventory, compliance) .add_edge(compliance, supervisor) .build() .as_agent() )</CODE></PRE> <P>This topology is easier to test and reason about than an unconstrained planner. Each specialist has one job and one tool allowlist. Full context is passed where synthesis requires it, while the supervisor remains tool-free.</P> <P>Request isolation matters too. A hosted process can serve concurrent users, so workflow state must not leak between requests. The sample creates a fresh workflow agent for each request context rather than reusing mutable agent state globally.</P> <H2>What the live hosted run showed</H2> <P>The hosted application completed a read-only assessment for the synthetic batch. The resulting brief reported:</P> <UL> <LI>2,196 affected units across four locations.</LI> <LI>A high-risk inbound temperature excursion.</LI> <LI>Supplier acknowledgement, a 36-hour replacement estimate, and a drafted credit note.</LI> <LI>Unknown transit temperature details, excursion duration, stability impact, final supplier disposition, and potentially issued stock.</LI> <LI>A recommendation to hold or quarantine stock, explicitly stating that no quarantine had occurred.</LI> <LI>A required human approval before any inventory restriction.</LI> </UL> <img /> <FIGURE> <FIGCAPTION>The live Hosted Agent decision brief. Transient response and correlation identifiers are masked; the operations rail is excluded because it contains actor-scoped audit data.</FIGCAPTION> </FIGURE> <P>The screenshot also shows an important truthfulness choice: the UI says <STRONG>Hosted workflow trace unavailable</STRONG>. The application does not invent stage completion or tool-call evidence when the hosted endpoint does not return trustworthy trace data. The answer can be displayed, but it must not be presented as proof of an internal execution path.</P> <H2>Approval is a protocol, not a button</H2> <P>The hosted web path uses App Service authentication with Microsoft Entra. The application accepts the injected principal only on the configured App Service host, validates tenant and object identifiers, applies a user allowlist, and performs an additional approver check for mutation requests. State-changing calls also require the expected origin and an application request header.</P> <P>Approval is then bound to five facts:</P> <OL> <LI>The authenticated actor.</LI> <LI>The current demo generation.</LI> <LI>The affected batch.</LI> <LI>The <CODE>quarantine</CODE> action.</LI> <LI>A ten-minute validity window until first use.</LI> </OL> <P>Resetting the demo creates a new generation, invalidating old handles. Consuming an approval does not make replay unsafe: the same bound handle can repeat the same quarantine operation, but domain code changes only positions that are not already quarantined. A second call reports an idempotent replay with zero additional positions changed.</P> <P>This is the difference between a human-in-the-loop interface and a human-authorized system. A modal dialog provides user experience; identity binding and deterministic policy provide control.</P> <H2>Durable state needs concurrency semantics</H2> <P>The hosted application stores each actor's synthetic session in a separate Blob object. A load returns both JSON state and its ETag. A save uses <CODE>IfNotModified</CODE> semantics; if another request updated the same state first, Azure Storage rejects the stale write and the API returns a conflict.</P> <PRE class="language-python" tabindex="0" contenteditable="false" data-lia-code-value="conditions = ( {&quot;etag&quot;: etag, &quot;match_condition&quot;: MatchConditions.IfNotModified} if etag else {} ) await blob.upload_blob( json.dumps(state), overwrite=etag is not None, **conditions, )"><CODE>conditions = ( {"etag": etag, "match_condition": MatchConditions.IfNotModified} if etag else {} ) await blob.upload_blob( json.dumps(state), overwrite=etag is not None, **conditions, )</CODE></PRE> <P>Without that condition, two browser requests could both read the same approval state and overwrite one another using last-writer-wins behavior. Agent systems do not get a concurrency exemption: ordinary distributed-systems rules still apply.</P> <H2>Fail closed, and make the failure legible</H2> <P>The analysis adapter accepts only HTTPS Foundry endpoints with the expected path, uses a managed-identity token for <CODE>https://ai.azure.com/.default</CODE>, disables redirects, and enforces bounded connect and overall timeouts. It accepts only a completed assistant response with non-empty output text.</P> <P>If the endpoint times out, returns partial output, returns malformed data, or becomes unavailable, the application clears the analysis lease and reports that no inventory changed. It does not substitute a local answer and label it as hosted. Approval remains locked until a new hosted analysis succeeds.</P> <P>This can feel strict during a demo, but it protects provenance. A degraded fallback is useful only when the UI and audit model can identify it accurately.</P> <H2>What is proven, and what is not</H2> <P>The sample provides useful evidence for several engineering claims:</P> <UL> <LI>Typed MCP tools reject malformed input.</LI> <LI>Hosted specialists receive read-only capabilities only.</LI> <LI>Approval is checked below the model and bound to identity and session state.</LI> <LI>Quarantine is idempotent in the synthetic domain.</LI> <LI>Blob ETags prevent stale session writes.</LI> <LI>Empty, partial, failed, and timed-out hosted responses fail closed.</LI> <LI>Local tests cover domain, MCP, workflow, API, and repository-hygiene behavior.</LI> </UL> <P>It does not prove that the sample is a production recall platform. The scenario is synthetic. The local audit log is not tamper-evident. The hosted UI currently lacks trustworthy per-stage and per-tool trace rendering. Deployment-specific RBAC, EasyAuth configuration, telemetry access, model behavior, load characteristics, costs, and recovery procedures require validation in each environment.</P> <P>Evaluation evidence also expires. Golden cases and evaluator configuration are useful assets, but historical results are not a current release certificate. Re-run evaluations against the deployed agent version and inspect failures before making quality claims.</P> <H2>Try the pattern</H2> <P>Start with the deterministic path before provisioning cloud resources:</P> <PRE class="language-powershell" tabindex="0" contenteditable="false" data-lia-code-value="Set-Location (git rev-parse --show-toplevel) py -3.13 -m venv caldova-recall-control/.venv ./caldova-recall-control/.venv/Scripts/python.exe -m pip install ` -r caldova-recall-control/requirements-ui.txt ./caldova-recall-control/.venv/Scripts/python.exe -m uvicorn ` control_tower_api:app ` --app-dir caldova-recall-control/src ` --host 127.0.0.1 ` --port 8091"><CODE>Set-Location (git rev-parse --show-toplevel) py -3.13 -m venv caldova-recall-control/.venv ./caldova-recall-control/.venv/Scripts/python.exe -m pip install ` -r caldova-recall-control/requirements-ui.txt ./caldova-recall-control/.venv/Scripts/python.exe -m uvicorn ` control_tower_api:app ` --app-dir caldova-recall-control/src ` --host 127.0.0.1 ` --port 8091</CODE></PRE> <P>Then inspect the MCP server over stdio:</P> <PRE class="language-powershell" tabindex="0" contenteditable="false" data-lia-code-value="./caldova-recall-control/.venv/Scripts/python.exe ` caldova-recall-control/scripts/inspect_mcp.py"><CODE>./caldova-recall-control/.venv/Scripts/python.exe ` caldova-recall-control/scripts/inspect_mcp.py</CODE></PRE> <P>The inspector discovers the real tool schemas, reads the synthetic inventory, rejects malformed input and an unapproved mutation, and confirms the stock remains unchanged. Only after that local contract is understood should you configure a Foundry project, deployment identity, model deployment, and Hosted Agent.</P> <H2>Engineering takeaways</H2> <P>The most reusable lesson in Caldova is not the number of agents. It is the placement of authority.</P> <UL> <LI>Give each model the smallest useful toolset.</LI> <LI>Prefer explicit workflow topology when the business process is known.</LI> <LI>Treat tool annotations as descriptive metadata, not access control.</LI> <LI>Bind consequential approval to authenticated identity, resource, action, and session generation.</LI> <LI>Put mutation and idempotency in deterministic domain code.</LI> <LI>Use optimistic concurrency for durable web state.</LI> <LI>Preserve provenance by failing closed instead of silently changing execution paths.</LI> <LI>Show only evidence the system actually captured.</LI> </UL> <P>Agents are excellent at turning fragmented evidence into an actionable brief. Reliable systems make sure the brief and the action remain two different things.</P> <H2>References</H2> <UL> <LI><A href="https://github.com/leestott/mcp-connect" target="_blank">Caldova source repository</A></LI> <LI><A href="https://modelcontextprotocol.io/docs/getting-started/intro" target="_blank">Model Context Protocol introduction</A></LI> <LI><A href="https://learn.microsoft.com/en-us/agent-framework/workflows/" target="_blank">Microsoft Agent Framework workflow capabilities</A></LI> <LI><A href="https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/deploy-hosted-agent" target="_blank">Deploy a Hosted Agent in Microsoft Foundry</A></LI> <LI><A href="https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad" target="_blank">Configure Microsoft Entra authentication for Azure App Service</A></LI> <LI><A href="https://learn.microsoft.com/en-us/azure/storage/blobs/concurrency-manage" target="_blank">Manage concurrency in Azure Blob Storage</A></LI> </UL> </ARTICLE> Thu, 24 Sep 2026 07:00:00 GMT https://techcommunity.microsoft.com/t5/microsoft-developer-community/engineering-agentic-recall-controls-with-mcp-and-microsoft/ba-p/4557549 Lee_Stott 2026-09-24T07:00:00Z https://techcommunity.microsoft.com/t5/azure-integration-services-blog/how-to-validate-that-your-biztalk-sb-messaging-adapter-is-really/ba-p/4559391 <P>On September 30, 2026, Azure Service Bus stops accepting the Service Bus Messaging Protocol (SBMP) — the protocol the BizTalk SB-Messaging adapter has always used. The failure mode is not a warning in a log file; it is a refused connection. To keep those integrations running, a BizTalk Server 2020 hotfix adds a new <STRONG>Azure.Messaging.ServiceBus</STRONG> AMQP implementation to the adapter in place of the legacy SBMP path.</P> <P>This post walks through how to validate the hotfix was successfully deployed and is using AMQP and not SBMP.</P> <P>&nbsp;</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><tbody><tr><td> <P><STRONG>Required baseline:</STRONG> BizTalk Server 2020 with <STRONG>Cumulative Update 6 or Cumulative Update 7</STRONG> installed, plus the SB-Messaging AMQP hotfix — <STRONG>KB5091379</STRONG>, obtained by opening a Microsoft support case. The hotfix is not offered through Windows Update or the regular CU download, and it will not install on a CU5 or earlier baseline.</P> <P><STRONG>Every node in the BizTalk group needs it.</STRONG> A multi-server group will happily run the affected host instance on an unpatched node, and your test may land on the one server where the fix is not active. Patch and restart host instances everywhere, then record the edition, CU level, hotfix number, and component build per server.</P> <P><STRONG>Hotfix location:&nbsp; </STRONG><STRONG><SPAN class="lia-text-color-8">https://1drv.ms/f/c/cac4b5f5988b8228/IgCrzn_KTaZ8T5tuKmcdPgXxARuOLcGHDhxVLgeysj44GWE?e=w5AcpM</SPAN></STRONG></P> </td></tr></tbody><colgroup><col style="width: 100.00%" /></colgroup></table></DIV> <P>&nbsp;</P> <P>Once the baseline is confirmed, test in a non-production environment that reproduces production topology, authentication, and the full network path — proxy, firewall, private endpoint, and DNS. And list every materially different configuration you intend to validate: each send port and receive location, queue, topic, and subscription usage, 32-bit versus 64-bit hosts, and features such as sessions, ordered delivery, or transactions. A green result on one port does not validate the others.</P> <H1>Method 1: Verify the active connection on port 5671 (recommended)</H1> <P>The adapter selects AMQP over TCP, and Azure Service Bus uses TCP port <STRONG>5671</STRONG> for AMQP over TLS. Correlating an established 5671 connection with the correct BTSNTSvc or BTSNTSvc64 process demonstrates that the BizTalk host is using the AMQP transport. Run elevated PowerShell while the receive location is enabled and actively polling:</P> <LI-CODE lang="powershell">$hostProcesses = Get-Process BTSNTSvc, BTSNTSvc64 -ErrorAction SilentlyContinue Get-NetTCPConnection -State Established -RemotePort 5671 | Where-Object OwningProcess -in $hostProcesses.Id | ForEach-Object { $process = Get-Process -Id $_.OwningProcess [pscustomobject]@{ Process = $process.ProcessName ProcessId = $_.OwningProcess LocalAddress = $_.LocalAddress LocalPort = $_.LocalPort RemoteAddress = $_.RemoteAddress RemotePort = $_.RemotePort State = $_.State } }</LI-CODE> <P><STRONG>Expected result:</STRONG></P> <UL> <LI>Process is BTSNTSvc or BTSNTSvc64.</LI> <LI>Remote port is 5671.</LI> <LI>State is Established.</LI> <LI>The remote address resolves to or corresponds to the Service Bus namespace.</LI> </UL> <P><STRONG>&nbsp;</STRONG><STRONG>What an empty result means:</STRONG> not much, on its own. An empty result is inconclusive, not a failure. Confirm the port or receive location is enabled, the host instance is running, traffic is actually flowing during the check, and that DNS, firewall, or private endpoint rules permit the connection — then repeat. One important exception: if your environment routes <STRONG>AMQP over WebSockets on TCP 443</STRONG>, you should not expect a 5671 connection at all. In that case skip to Method 2.</P> <H1>Method 2: Capture adapter traces</H1> <P>When the connection view is unavailable or ambiguous, the trace is the more definitive answer, because it shows which code path executed rather than which socket happened to be open. BizTalk adapter tracing uses ETW through <STRONG>BT.Trace.Tracer</STRONG>, and entries containing <STRONG>[SBMessaging-AMQP]</STRONG> confirm that the new AMQP-specific implementation executed.</P> <OL> <LI>Start BizTalk adapter tracing immediately before the test — not hours earlier.</LI> <LI>Send or receive a single, uniquely identifiable test message through the target port or receive location.</LI> <LI>Stop tracing as soon as the message completes.</LI> <LI>Search the captured output for <STRONG>[SBMessaging-AMQP]</STRONG> entries inside the test window, and match them to the host instance and configuration you were exercising.</LI> </OL> <H1>Method 3: Block the legacy SBMP ports</H1> <P>Methods 3 and 4 are corroborating tests, not proof, and belong in an isolated environment. Legacy SBMP commonly uses TCP ports 9350 through 9354. If the isolated AMQP workload continues to operate while those ports are blocked and TCP 5671 remains available, the result corroborates that the workload does not depend on SBMP. Record the original firewall rules before you start and restore them immediately afterwards — this test has a real blast radius if it escapes the test subnet.</P> <H1>Method 4: Large message functional test</H1> <P>In Basic and Standard tiers, the maximum message size is <STRONG>256 KB</STRONG>, regardless of SDK or protocol, so this test does not apply there. In Premium, the legacy SBMP path supports messages only up to <STRONG>1 MB</STRONG>, whereas AMQP supports larger messages up to the entity’s configured maximum of <STRONG>100 MB</STRONG>. Successfully processing a Premium message larger than 1 MB therefore provides supplementary evidence that the adapter is using AMQP.</P> <P>Read a failure carefully: entity limits, timeouts, and pipeline constraints all produce the same symptom, so a failed large-message test is not by itself evidence that the hotfix did not take. Verify payload integrity and the event log, then remove the test message and restore any temporary entity settings.</P> <H1>Do not stop at the protocol</H1> <P>Confirming that AMQP is in use answers the transport question. It does not answer whether your solution still behaves the same way. AMQP and SBMP differ in a handful of behavioural details, so before you call the validation complete, run the scenarios your integrations depend on and compare against a pre-change baseline:</P> <UL> <LI>Send and receive across each representative queue, topic, and subscription path, checking message body and application-property fidelity.</LI> <LI>Peek-lock completion, abandon, defer, dead-letter, and retry behaviour, plus sessions, ordering, transactions, and duplicate detection where you use them.</LI> <LI>Authentication renewal, and recovery after a host instance restart or a brief network interruption.</LI> </UL> <P>Throughput and latency within your accepted baseline, with no new event log errors, suspended instances, duplicates, or lost messages.</P> <P>&nbsp;</P> Thu, 24 Sep 2026 04:15:15 GMT https://techcommunity.microsoft.com/t5/azure-integration-services-blog/how-to-validate-that-your-biztalk-sb-messaging-adapter-is-really/ba-p/4559391 hcamposu 2026-09-24T04:15:15Z https://techcommunity.microsoft.com/t5/microsoft-developer-community/how-do-you-know-what-to-optimize-next-in-your-ai-agent-ask-the/ba-p/4559401 <P><SPAN data-contrast="auto">&nbsp;</SPAN></P> <BLOCKQUOTE> <P><SPAN data-contrast="auto">Join us live to get a demo of the capabilities then engage with the experts in a Q&amp;A. Bring your questions – post them in Discord ahead of time or ask them during the session.</SPAN><SPAN data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335551550&quot;:0,&quot;335551620&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:240}">&nbsp;</SPAN></P> <P><SPAN data-contrast="auto"><STRONG>Save the date</STRONG>: 1:30-2:00pm ET, Sep 25, 2026 </SPAN>&nbsp;<BR /><SPAN data-contrast="auto"><STRONG>Join the Discord</STRONG>: </SPAN><A href="https://aka.ms/model-mondays/discord" target="_blank" rel="noopener"><SPAN data-contrast="none"><SPAN data-ccp-charstyle="Hyperlink">https://aka.ms/model-mondays/discord</SPAN></SPAN></A><SPAN data-contrast="auto">&nbsp;</SPAN>&nbsp;<BR /><SPAN data-contrast="auto"><STRONG>Join the AMA live</STRONG>: </SPAN><A href="https://aka.ms/FoundryFriday-Optimizer-Insights" target="_blank" rel="noopener"><SPAN data-contrast="none"><SPAN data-ccp-charstyle="Hyperlink">https://aka.ms/FoundryFriday-Optimizer-Insights</SPAN></SPAN></A><SPAN data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335551550&quot;:0,&quot;335551620&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:240}">&nbsp;</SPAN></P> </BLOCKQUOTE> <P><SPAN data-contrast="auto"><BR />You shipped an agent. It is running in production. Now comes the harder question: W<STRONG>hat should you optimize first, and how do you move from recurring behaviors in your traces to better instructions, tools, skills, and model choices?</STRONG></SPAN><SPAN data-ccp-props="{}">&nbsp;</SPAN></P> <P><SPAN data-contrast="auto">That is exactly what we will explore in this week’s Foundry Friday Ask Me Anything (AMA) - let's talk about how insights in Foundry and agent optimizer can help you move from production signals to practical improvements. Join us as we talk to Charles Kim, the Product Lead for these features at Core AI. See a live demo, bring your own agent optimization questions, and get answers and actionable advice from the people who build the product.</SPAN></P> <H2 aria-level="2"><SPAN data-contrast="none"><SPAN data-ccp-parastyle="heading 2">Start with the patterns hiding in your traces</SPAN></SPAN><SPAN data-ccp-props="{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}"> ..</SPAN></H2> <P><SPAN data-contrast="auto">Insights in Foundry</SPAN><SPAN data-contrast="auto"> analyzes traces from production agents and organizes recurring behaviors into reviewable insights. Instead of combing through isolated runs, you can examine representative traces, see which agent versions are affected, explore likely causes, and identify recommended next actions.</SPAN><SPAN data-ccp-props="{}"> &nbsp;</SPAN><SPAN data-contrast="auto">That changes the developer question from “<EM>What happened in this trace</EM>?” to “<STRONG><EM>What keeps happening across my agents at scale, and what should I improve next?</EM></STRONG>”</SPAN><SPAN data-ccp-props="{}">&nbsp;<BR /></SPAN><A href="https://learn.microsoft.com/en-us/azure/foundry/observability/how-to/agent-insights" target="_blank" rel="noopener"><SPAN data-contrast="none"><SPAN data-ccp-charstyle="Hyperlink">Learn more about insights in Foundry</SPAN></SPAN></A><SPAN data-ccp-props="{}">&nbsp;</SPAN></P> <P><SPAN style="color: rgb(30, 30, 30); font-size: 32px;" data-contrast="none"><SPAN data-ccp-parastyle="heading 2">Then turn those findings into better agent configurations</SPAN></SPAN><SPAN style="color: rgb(30, 30, 30); font-size: 32px;" data-ccp-props="{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}">&nbsp;</SPAN></P> <P><SPAN data-contrast="auto">Agent optimizer in Foundry Agent Service</SPAN><SPAN data-contrast="auto"> helps you improve prompt agents and hosted agents by automatically evaluating their behavior and generating stronger configurations. It can refine instructions, skills, tool descriptions, and model selections, so you can spend less time manually tuning prompts and more time building the experience that makes your agent useful.</SPAN><SPAN data-ccp-props="{}">&nbsp;</SPAN></P> <P><SPAN data-contrast="auto">Together, insights and optimization create a practical loop: observe how your agent behaves in the real world, identify recurring opportunities, make targeted improvements, and evaluate again.</SPAN><SPAN data-ccp-props="{}">&nbsp;</SPAN></P> <P><A href="https://learn.microsoft.com/en-us/azure/foundry/agents/concepts/agent-optimizer-overview?source=docs" target="_blank" rel="noopener"><SPAN data-contrast="none"><SPAN data-ccp-charstyle="Hyperlink">Learn more about agent optimizer</SPAN></SPAN></A><SPAN data-ccp-props="{}">&nbsp;<BR /></SPAN></P> <H2 aria-level="2"><SPAN data-contrast="none"><SPAN data-ccp-parastyle="heading 2">Want to see that loop in action?</SPAN><SPAN data-ccp-parastyle="heading 2"> Join us for the Foundry Friday AMA.</SPAN></SPAN><SPAN data-ccp-props="{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}">&nbsp;</SPAN></H2> <BLOCKQUOTE> <P><SPAN data-contrast="auto">If you are wondering how these capabilities fit into your own development workflow, or what they can reveal about an agent already in production, <STRONG>bring that question to the people building them</STRONG>.</SPAN> <SPAN data-contrast="auto">The team behind the insights in Foundry and agent optimizer in Foundry Agent Service will join us for a live AMA on the Microsoft Foundry Discord. Join us live to get a demo of the capabilities then engage with the experts in a Q&amp;A. Bring your questions – post them in Discord ahead of time or ask them during the session.</SPAN><SPAN data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335551550&quot;:0,&quot;335551620&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:240}">&nbsp;</SPAN></P> <P><SPAN data-contrast="auto"><STRONG>Save the date</STRONG>: 1:30-2:00pm ET, Sep 25, 2026 </SPAN>&nbsp;<BR /><SPAN data-contrast="auto"><STRONG>Join the Discord</STRONG>: </SPAN><A href="https://aka.ms/model-mondays/discord" target="_blank" rel="noopener"><SPAN data-contrast="none"><SPAN data-ccp-charstyle="Hyperlink">https://aka.ms/model-mondays/discord</SPAN></SPAN></A><SPAN data-contrast="auto">&nbsp;</SPAN>&nbsp;<BR /><SPAN data-contrast="auto"><STRONG>Join the AMA live</STRONG>: </SPAN><A href="https://aka.ms/FoundryFriday-Optimizer-Insights" target="_blank" rel="noopener"><SPAN data-contrast="none"><SPAN data-ccp-charstyle="Hyperlink">https://aka.ms/FoundryFriday-Optimizer-Insights</SPAN></SPAN></A><SPAN data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335551550&quot;:0,&quot;335551620&quot;:0,&quot;335559738&quot;:240,&quot;335559739&quot;:240}">&nbsp;</SPAN></P> </BLOCKQUOTE> <P><SPAN data-ccp-props="{}">&nbsp;</SPAN></P> <img /> <P>&nbsp;</P> Thu, 24 Sep 2026 03:41:03 GMT https://techcommunity.microsoft.com/t5/microsoft-developer-community/how-do-you-know-what-to-optimize-next-in-your-ai-agent-ask-the/ba-p/4559401 nitya 2026-09-24T03:41:03Z https://techcommunity.microsoft.com/t5/azure-infrastructure-blog/catalyst-frontier-stories-of-ai-infrastructure-innovation/ba-p/4559362 <H4>In the Catalyst series, we explore the transformative power of AI by showcasing visionary companies driving scientific and industry breakthroughs powered by Azure and NVIDIA. This video series spotlights how innovation ignites action and how today’s visionaries are shaping tomorrow with the power of AI and cloud innovation.</H4> <H2><SPAN class="lia-text-color-10"><STRONG>Building resilience against extreme weather</STRONG></SPAN></H2> <div data-video-id="https://www.youtube.com/watch?v=-tbRz33WANo&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=2&amp;t=268s&amp;pp=iAQB/1790179416703" data-video-remote-vid="https://www.youtube.com/watch?v=-tbRz33WANo&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=2&amp;t=268s&amp;pp=iAQB/1790179416703" class="lia-video-container lia-media-is-center lia-media-size-large"><iframe src="https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Fwww.youtube.com%2Fembed%2F-tbRz33WANo%3Flist%3DPLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP%26start%3D268&amp;display_name=YouTube&amp;url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D-tbRz33WANo&amp;image=https%3A%2F%2Fi.ytimg.com%2Fvi%2F-tbRz33WANo%2Fhqdefault.jpg&amp;type=text%2Fhtml&amp;schema=youtube" allowfullscreen="" style="max-width: 100%"></iframe></div> <P>Tomorrow.io turns space-based data into AI-driven forecasting powered by Azure and NVIDIA at a global scale. Its high-performance AI models deliver real-time weather intelligence that helps governments and enterprises anticipate disruption, optimize operations, and act faster in the face of severe events.</P> <H2><STRONG><SPAN class="lia-text-color-10">Expanding access in preventative healthcare</SPAN></STRONG></H2> <div data-video-id="https://www.youtube.com/watch?v=FZrapwvfkNE&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=1&amp;t=14s&amp;pp=iAQB/1790179497156" data-video-remote-vid="https://www.youtube.com/watch?v=FZrapwvfkNE&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=1&amp;t=14s&amp;pp=iAQB/1790179497156" class="lia-video-container lia-media-is-center lia-media-size-large"><iframe src="https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FFZrapwvfkNE%3Flist%3DPLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP%26start%3D14&amp;display_name=YouTube&amp;url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DFZrapwvfkNE&amp;image=https%3A%2F%2Fi.ytimg.com%2Fvi%2FFZrapwvfkNE%2Fhqdefault.jpg&amp;type=text%2Fhtml&amp;schema=youtube" allowfullscreen="" style="max-width: 100%"></iframe></div> <P>Powered by Microsoft Azure and NVIDIA, Helfie uses multimodal AI to transform smartphone selfies into intelligent health screening at scale. By combining advanced models with real-time inference, it delivers rapid biometric insights that help identify risks earlier and expand access to remote and underserved communities.</P> <H2><STRONG><SPAN class="lia-text-color-10">How AI is mapping the tree of life</SPAN></STRONG></H2> <div data-video-id="https://www.youtube.com/watch?v=IbN3ClySZsg&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=4&amp;t=5s&amp;pp=iAQB/1790179729378" data-video-remote-vid="https://www.youtube.com/watch?v=IbN3ClySZsg&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=4&amp;t=5s&amp;pp=iAQB/1790179729378" class="lia-video-container lia-media-is-center lia-media-size-large"><iframe src="https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FIbN3ClySZsg%3Flist%3DPLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP%26start%3D5&amp;display_name=YouTube&amp;url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DIbN3ClySZsg&amp;image=https%3A%2F%2Fi.ytimg.com%2Fvi%2FIbN3ClySZsg%2Fhqdefault.jpg&amp;type=text%2Fhtml&amp;schema=youtube" allowfullscreen="" style="max-width: 100%"></iframe></div> <P>Powered by Azure and NVIDIA to build the world’s largest biological databases, Basecamp Research is decoding the complexity of biology to accelerate scientific breakthroughs.</P> <H2><STRONG><SPAN class="lia-text-color-10">Building the next frontier of data</SPAN></STRONG></H2> <div data-video-id="https://www.youtube.com/watch?v=IeNwoTAgmsk&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=5&amp;t=253s&amp;pp=iAQB/1790179786937" data-video-remote-vid="https://www.youtube.com/watch?v=IeNwoTAgmsk&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=5&amp;t=253s&amp;pp=iAQB/1790179786937" class="lia-video-container lia-media-is-center lia-media-size-large"><iframe src="https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FIeNwoTAgmsk%3Flist%3DPLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP%26start%3D253&amp;display_name=YouTube&amp;url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DIeNwoTAgmsk&amp;image=https%3A%2F%2Fi.ytimg.com%2Fvi%2FIeNwoTAgmsk%2Fhqdefault.jpg&amp;type=text%2Fhtml&amp;schema=youtube" allowfullscreen="" style="max-width: 100%"></iframe></div> <P>Powered by Microsoft Azure and NVIDIA, Global Objects is digitizing the real world by creating high-fidelity digital twins of over 5 million physical items. These photorealistic 3D models are transforming immersive content creation across Hollywood, gaming, robotics, and cultural preservation.</P> <H2><STRONG><SPAN class="lia-text-color-10">Changing how doctors diagnose diseases with AI</SPAN></STRONG></H2> <div data-video-id="https://www.youtube.com/watch?v=yKPu8n42LPs&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=3&amp;t=20s&amp;pp=iAQB/1790179835555" data-video-remote-vid="https://www.youtube.com/watch?v=yKPu8n42LPs&amp;list=PLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP&amp;index=3&amp;t=20s&amp;pp=iAQB/1790179835555" class="lia-video-container lia-media-is-center lia-media-size-large"><iframe src="https://cdn.embedly.com/widgets/media.html?src=https%3A%2F%2Fwww.youtube.com%2Fembed%2FyKPu8n42LPs%3Flist%3DPLFPUGjQjckXGwSzAMLFBXhu9G7PiQyBMP%26start%3D20&amp;display_name=YouTube&amp;url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DyKPu8n42LPs&amp;image=https%3A%2F%2Fi.ytimg.com%2Fvi%2FyKPu8n42LPs%2Fhqdefault.jpg&amp;type=text%2Fhtml&amp;schema=youtube" allowfullscreen="" style="max-width: 100%"></iframe></div> <P>Powered by Microsoft Azure and NVIDIA, Pangaea Data is closing care gaps by identifying untreated and under-treated patients across rare and hard-to-diagnose diseases faster, earlier, and more accurately.</P> <H3><SPAN class="lia-text-color-10"><STRONG>Learn more</STRONG></SPAN></H3> <P>The Catalyst series explores how organizations are using AI infrastructure to tackle some of their most complex technical and business challenges, from accelerating scientific discovery to advancing autonomous systems and transforming core industries.&nbsp;</P> <P>Learn more about <A class="lia-external-url" href="https://datacenters.microsoft.com/catalyst-series/" target="_blank" rel="noopener">Catalyst</A>.</P> <P>Learn more about <A class="lia-external-url" href="https://azure.microsoft.com/en-us/solutions/high-performance-computing/ai-infrastructure?msockid=2d4dccd6b15a6db43209db0bb0266ca9" target="_blank" rel="noopener">Azure AI infrastructure</A>.&nbsp;</P> Wed, 23 Sep 2026 17:05:19 GMT https://techcommunity.microsoft.com/t5/azure-infrastructure-blog/catalyst-frontier-stories-of-ai-infrastructure-innovation/ba-p/4559362 abbyhamilton 2026-09-23T17:05:19Z https://techcommunity.microsoft.com/t5/azure-arc/blog-azure-local-tools-community-projects-microsoft-official/m-p/4559365#M1562 <PRE><STRONG>Disclaimer: </STRONG>This blog is a community contribution and does not reflect the opinion on behalf of Microsoft. Statements herein should not be understood as an official statement from Microsoft in any way. The community is invited to participate through commenting.</PRE> <H4><BR /><STRONG>Changelog</STRONG></H4> <P>1.6 - added Azure Arc and Azure version history<BR />1.5 - added CMTrace projects<BR />1.4 - Improved readability by including long links into the description, added Lenovo section. Thank you to all contributors via LinkedIn!<BR />1.3 - moved Azure Local LENS from Microsoft to Community section, added missing TSG Link<BR />1.2 - Improved readability by including long links into the description, updated Dell and HPE sections<BR />1.1 - Added LinkedIn Newsletter, added S2DCalc Link<BR />1.0 - Initial version</P> <H4><STRONG>Introduction</STRONG></H4> <P>This blogpost serves as a practical guide and one-stop hub to community and official tooling for Azure Local, with links to GitHub, Microsoft Learn, and OEM docs.<BR />Azure Local brings Azure services on-premises. This post maps the tooling ecosystem - <STRONG>community GitHub projects</STRONG>, <STRONG>official Microsoft utilities</STRONG>, and <STRONG>OEM documentation, </STRONG>with links to key resources. Use can use community tools for labs and production environments, if your internal regulations allow, or during PoC / deployment phases.</P> <H4><STRONG>Reasoning</STRONG></H4> <P>Azure Local (Azure services running on local hardware) is evolving rapidly. For teams evaluating or operating Azure Local, the tooling ecosystem matters: community projects accelerate labs and automation, Microsoft tools provide authoritative testing and sizing, and OEM documentation ensures hardware compatibility and supportability and official guidance tailored to OEM specific requirements. This article seperates community projects from Microsoft official tools, providing links to the most useful resources.&nbsp;</P> <H4><STRONG>Quick overview table</STRONG></H4> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="width: 100%; height: 666px; border-width: 1px;"><thead><tr style="height: 35px;"><th style="height: 35px;"><STRONG>Category</STRONG></th><th style="height: 35px;"><STRONG>Representative tools</STRONG></th><th style="height: 35px;"><STRONG>Primary use</STRONG></th></tr></thead><tbody><tr style="height: 131px;"><th style="height: 131px;"><STRONG>Community tools</STRONG></th><td style="height: 131px;"><STRONG>Azure Local ODIN<BR />Azure Local LENS Azure Dashboard<BR />Azure Local Cluster Manager<BR />HVTools<BR />S2DCalc<BR />CMTrace projects</STRONG></td><td style="height: 131px;">Development, local cluster orchestration, hardware validation</td></tr><tr style="height: 107px;"><th style="height: 107px;"><STRONG>Official Microsoft tools</STRONG></th><td style="height: 107px;"><STRONG>VMfleet 2.0<BR />DiskSPD<BR />Azure Local Troubleshooting Guide (TSG)<BR />Azure Local Solutions<BR /></STRONG></td><td style="height: 107px;">Performance testing, official sizing, troubleshooting, cataloging validated configurations</td></tr><tr style="height: 203px;"><th style="height: 203px;"><STRONG>OEM-specific resources</STRONG></th><td style="height: 203px;"><STRONG>Dell user and deployment guides<BR />Dell OpenManage for WAC<BR />Dell Azure Local Compatibility Matrix and Azure Local related Downloads incl. factory-images and SBE information.<BR /><BR /><BR />HPE user and deployment guides<BR />HPE Solution Tier description<BR />HPE SBE Minimal and Standard downloads<BR /><BR />Lenovo user and deployment guides<BR />Lenovo XClarity Integrator extension for WAC<BR />Lenovo SBE Downloads<BR /></STRONG></td><td style="height: 203px;">Hardware compatibility, licensing, vendor-specific deployment guidance</td></tr><tr style="height: 107px;"><th style="height: 107px;"> <P><STRONG>Official learning resources and community content</STRONG></P> </th><td style="height: 107px;"><STRONG>Microsoft Learn Azure Arc series<BR />Azure Local documentation<BR />Azure Local and Azure Arc release notes<BR />Reach out to MVPs, learn from their blogs<BR />Recommended Youtube channels</STRONG></td><td style="height: 107px;">Training, conceptual grounding, official reference</td></tr><tr style="height: 83px;"><th style="height: 83px;"> <P><STRONG>Open Communities</STRONG></P> </th><td style="height: 83px;"><STRONG>Azure Local Slack<BR />Azure Local Tech Talk</STRONG></td><td style="height: 83px;">Highlighting active and enganging communities with news, voluntary support and answering questions</td></tr></tbody><colgroup><col style="width: 33.3333%" /><col style="width: 33.3333%" /><col style="width: 33.3333%" /></colgroup></table></DIV> <H4><STRONG><BR />Community tools</STRONG></H4> <P><STRONG>Why community tools matter? </STRONG>Community projects fill practical gaps, provide automation for labs and PoCs, and iterate quickly to reflect real-world needs. They’re ideal for rapid prototyping and developer workflows, which may not be provided by the vendor to this extend.<BR /><BR /></P> <P><STRONG>Notable community projects</STRONG></P> <UL> <LI><STRONG>Azure Local ODIN</STRONG> - A community toolkit for Azure Local that simplifies cluster setup and DevOps oriented deployment. It also incudes a hardwae and storage sizing tool. Will generate architecture diagrams of the current or a future deployment and support various types of deployment and resources. Documentation and examples are available on the ODIN for Azure Local site.&nbsp; While maintained by Microsoft employees, this project should be considered for use without any product support by Microsoft. Link: <A class="lia-external-url" href="https://azure.github.io/odinforazurelocal" target="_blank" rel="noopener">https://azure.github.io/odinforazurelocal</A><BR /><BR /></LI> <LI><STRONG>Azure Local LENS </STRONG>- Azure Local Lifecycle, Events &amp; Notification Status (LENS) workbook brings together the signals you need to understand your Azure Local estate through a fleet lens. Instead of jumping between individual resources, you can use a consistent set of views to compare instances, spot outliers, and drill into the focus areas that need attention. LENS workbook provides comprehensive visibility into cluster health, update readiness, and workload status across your entire Azure Local fleet. JSON file to be imported into an Azure Dashboard. While the repository is hosted in the official Microsoft Azure repository, mind the disclaimer about supportability, indicating the same state as for Azure ODIN. Link: <A class="lia-external-url" href="https://aka.ms/AzureLocalLENS" target="_blank" rel="noopener" aria-label="https://aka.ms/AzureLocalLENS öffnen">https://aka.ms/AzureLocalLENS</A><BR /><BR /></LI> <LI><STRONG>Azure Local Management Tool </STRONG>- RBAC compatible community tool that helps with provisioning, upgrades, and lifecycle tasks for Azure Local clusters beyond anything currently available in the Azure Portal. If you have searched for a single website managing and operating Azure Local, search no longer. <BR />Link:&nbsp;<A class="lia-external-url" href="https://azurelocalmanager.com/" target="_blank" rel="noopener">https://azurelocalmanager.com/</A><BR /><BR /></LI> <LI><STRONG>HVTools</STRONG> - as the name suggests HVTools ports the familiar strengths of a very well-known tool, available for Broadcom's VMware, to Hyper-V administrators, which includes Azure Local. Discover and inventory your Virtual Machine estate and their configuration at a glance. Link:&nbsp;<A class="lia-external-url" href="https://hvtools.app/" target="_blank" rel="noopener">https://hvtools.app/</A>.<BR />Known <A class="lia-external-url" href="https://learn.microsoft.com/en-us/azure/azure-local/manage/virtual-machine-operations?view=azloc-2609&amp;viewFallbackFrom=azloc-2601?wt.mc_id=MVP_338345" target="_blank" rel="noopener">Management restrictions</A> apply to <U>Azure created / deployed VMs</U> on Azure Local.<BR /><BR /></LI> <LI><STRONG>S2D Calculator&nbsp;</STRONG>- Prime calulator for Storage Spaces Direct (S2D) for Windows Server and Azure Local, returning reliable and production relevant results for all supported storage configurations. Link: <A class="lia-external-url" href="https://s2d-calculator.com/" target="_blank" rel="noopener">https://s2d-calculator.com/</A>&nbsp;<BR /><BR /></LI> <LI><STRONG>CMTrace projects&nbsp;</STRONG>- CMTrace is a well-known tool provided and licensed by Microsoft, greatly simplying reading and understanding logs off many kinds.<BR />To overcome the licensing limitations, usually shipped as part of the System Center product family the community has established two noteable projects: <UL> <LI><A class="lia-external-url" href="https://cmtrace.dev/" target="_blank" rel="noopener">CMtrace.dev</A> - A high performance browser-based CMtrace-like parser, which handles different logs, archives on your local device, without uploading them anywhere</LI> <LI><A class="lia-external-url" href="https://github.com/adamgell/cmtraceopen" target="_blank" rel="noopener">CMtrace.Open </A>- an open-source project bringing the capabilites of CMTrace to everyone, requires local installation.</LI> </UL> </LI> </UL> <H4><STRONG>Official Microsoft tools</STRONG></H4> <P><STRONG>Why use official tools:</STRONG> Microsoft’s tools are the authoritative source for performance testing, sizing, and troubleshooting; they align with Azure Local support boundaries and validated configurations. All tools are supported by the respective vendor, unless stated otherwise.<BR /><BR /></P> <UL> <LI><A class="lia-external-url" href="https://github.com/microsoft/diskspd/wiki/VMFleet" target="_blank" rel="noopener"><STRONG>Microsoft VMfleet 2.0</STRONG></A> - Scales VM workload generation across nodes for stress and performance testing; ideal for validating cluster behavior under realistic load. <A class="lia-internal-link lia-internal-url lia-internal-url-content-type-blog" href="https://techcommunity.microsoft.com/blog/azurestackblog/next-generation-performance-tools-vmfleet-2-0/2772752?wt.mc_id=MVP_338345" target="_blank" rel="noopener" data-lia-auto-title="Documentation" data-lia-auto-title-active="0">Documentation</A><BR /><BR /></LI> <LI><STRONG style="color: rgb(30, 30, 30);"><A class="lia-external-url" href="https://github.com/microsoft/diskspd" target="_blank" rel="noopener">Microsoft DiskSPD</A></STRONG><SPAN style="color: rgb(30, 30, 30);">- Microsoft’s I/O supported workload generator for storage performance characterization. Use diskspd for storage microbenchmarks and to validate storage subsystem behavior under customizeable and relastic workloads. Works best with VMfleet, with or without Arc Enablement.<BR /><BR /></SPAN></LI> <LI><STRONG style="color: rgb(30, 30, 30);"><A class="lia-external-url" href="https://github.com/Azure/AzureLocal-Supportability" target="_blank" rel="noopener">Microsoft Azure Local TSG (Troubleshooting Guide)</A></STRONG><SPAN style="color: rgb(30, 30, 30);"> - Official runbooks and troubleshooting steps for common Azure Local issues; consult the Azure Local docs for the latest TSG content. See Azure Local documentation for troubleshooting and operational guidance. In addition the GitHub repository includes the <STRONG>CSSTool for Azure Local</STRONG>. Community can and should contribute here filing issues, when reproducible, as well as checking before raising support requests, if the issue is a known one, and a remediation description is available.&nbsp;<BR /><BR /></SPAN></LI> <LI><STRONG>Microsoft Azure Local Solutions</STRONG> <UL> <LI><STRONG><A class="lia-external-url" href="http://&nbsp;https://azurelocalsolutions.azure.microsoft.com/#/catalog" target="_blank" rel="noopener">Catalog</A></STRONG>- The offical list of certified hardware offerings for Azure Local deployments; always cross-check catalog entries before procurement.</LI> <LI><STRONG><A class="lia-external-url" href="https://azurelocalsolutions.azure.microsoft.com/#/Learn" target="_blank" rel="noopener">Solution categories</A> </STRONG>- Understanding differences of Microsoft Azure Local solution categories</LI> <LI><STRONG><A class="lia-external-url" href="https://azurelocalsolutions.azure.microsoft.com/#/sizer" target="_blank" rel="noopener">Sizing tool</A> </STRONG>(rather limited) - Official sizing tool to estimate hardware and configuration needs for target workloads.</LI> </UL> </LI> </UL> <H4><STRONG>OEM-specific resources</STRONG></H4> <P>OEM documentation and compatibility matrices are essential because Azure Local runs on certified hardware stacks. Vendor docs cover firmware, management interfaces, licensing, and validated configurations.</P> <H5><STRONG>Dell</STRONG></H5> <UL> <LI><STRONG><A class="lia-external-url" href="https://infohub.delltechnologies.com/en-us/t/guides-azure-stack-hci-os-24h2-or-ws-2025-and-later/" target="_blank" rel="noopener">Dell Azure Local Deployment Guides</A></STRONG>&nbsp;- provides a step-by-step documentation for Dell Azure Local deployments.</LI> <LI><STRONG><A class="lia-external-url" href="https://www.dell.com/support/kbdoc/en-us/000177828/support-for-dell-emc-openmanage-integration-with-microsoft-windows-admin-center?msockid=0cba1f1194136ff62047084f95716ef2" target="_blank" rel="noopener">Dell Open Manage Extension for Windows Admin Center (OMIMSWAC)&nbsp;</A></STRONG>- Management extension and compliance checks for Azure Local clusters and hardware. Also supports Windows Server Standalone and Windows Server S2D clusters.</LI> <LI><A class="lia-external-url" href="https://democenter.dell.com/interactive/ITD-0243" target="_blank" rel="noopener"><STRONG>Dell Demo Center</STRONG></A> - Interactive demos and product walkthroughs that show Dell hardware and management integration.</LI> <LI><A class="lia-external-url" href="https://learning.dell.com/content/dell/en-us/home/store/search.html?x=azure%20local%26field=by%20Keyword" target="_blank" rel="noopener"><STRONG>Dell Learning</STRONG></A> - Dell’s learning portal includes courses and search for Azure Local–related content.</LI> <LI><STRONG><A class="lia-external-url" href="https://dell.github.io/azurestack-docs/docs/hci/supportmatrix/" target="_blank" rel="noopener">Dell Compatibility Matrix</A></STRONG> - offers information and dowloads about SBE, factory images, driver and firmware best recipes and common HW related settings, that come preconfigured. Caveat: Please ensure checking for the correct version. Classical browser favorites tend to become outdated, rapidly!</LI> </UL> <H5><STRONG>HPE</STRONG></H5> <UL> <LI><STRONG><A href="https://www.hpe.com/us/en/alliance/microsoft/azurelocal.html" target="_blank" rel="noopener">HPE Azure Local Main Landing Page</A></STRONG> - highlights the HPE platforms and storage platforms supported with Azure Local.</LI> <LI><STRONG><A href="https://www.hpe.com/psnow/doc/a50008245enw?jumpid=in_pdfviewer-psnow" target="_blank" rel="noopener">HPE Azure Local Technical Whitepaper</A></STRONG> - Describes the tiers for Azure Local, the HPE platforms for each, server options that are supported, HPE switches that are supported, critical information relative to deployment, Windows Admin Extensions, available HPE services, and more.</LI> <LI><STRONG><A href="https://support.hpe.com/hpesc/public/docDisplay?docId=sd00006156en_us&amp;page=GUID-1FDA2FAC-F436-4FBC-97B7-DEAA53E54AA4.html&amp;docLocale=en_US" target="_blank" rel="noopener">HPE ProLiant for Azure Local Solutions User Guide</A></STRONG> - Targeting Integrated Systems and Premier Solutions, this guide provides information related to Azure Local hardware, solution management, credential management, system expansion, deployment and redeployment of the OS, known issues, troubleshooting, and more.</LI> <LI><A href="https://support.hpe.com/hpesc/public/docDisplay?docId=sd00006156en_us&amp;page=GUID-1FDA2FAC-F436-4FBC-97B7-DEAA53E54AA4.html&amp;docLocale=en_US" target="_blank" rel="noopener"><STRONG>HPE ProLiant for Azure Local Solutions Firmware and Software Compatibility Guide</STRONG></A> - Illustrates the N and N-1 driver, firmware, and software versions included in the Standard Solution Builder Extension for Azure Local.</LI> <LI><STRONG><A href="https://support.hpe.com/km/software/MTX-57e08c6fd1c246dd" target="_blank" rel="noopener">HPE Minimal Solution Builder Extension</A></STRONG> - For Validated Nodes ONLY, includes a Windows Defender Application Control policy enabling deployment of HPE components included in specific releases of the Service Pack for ProLiant. Note that the package does NOT include drivers, firmware, or other software.</LI> <LI><STRONG><A href="https://support.hpe.com/km/software/MTX-71c622ae839a4d4f" target="_blank" rel="noopener">HPE Standard Solution Builder Extension</A></STRONG> - For Integrated Systems and Premier Solutions ONLY, includes a Windows Defender Application Control policy as well as the drivers, firmware, and software necessary for updating an Azure Local instance/cluster.</LI> </UL> <H5><STRONG>Lenovo</STRONG></H5> <UL> <LI><STRONG><A class="lia-external-url" href="https://lenovopress.lenovo.com/servers/thinkagile/mx-series" target="_blank" rel="noopener">Lenovo ThinkAgile MX Series for Microsoft Azure Local </A></STRONG>- Main Lenovo Azure Local landing page featuring ThinkAgile MX solutions, deployment resources, product guides, and customer case studies.&nbsp;</LI> <LI><STRONG><A class="lia-external-url" href="http://%20https://pubs.lenovo.com/thinkagile-mx/mx_appliances" target="_blank" rel="noopener">Lenovo ThinkAgile MX Documentation Portal</A> </STRONG>- Official deployment, administration, lifecycle management, and operations guidance for Azure Local solutions<STRONG>.</STRONG><STRONG>&nbsp;</STRONG></LI> <LI><STRONG><A class="lia-external-url" href="https://pubs.lenovo.com/thinkagile-mx/xclarity_integrator_for_msw_adc" target="_blank" rel="noopener">Lenovo XClarity Integrator for Microsoft Windows Admin Center&nbsp;</A>- </STRONG>Windows Admin Center Management extension providing hardware monitoring,<STRONG> </STRONG>compliance checks, firmware lifecycle management, and cluster-aware updates for Windows Server and Azure Local environments.</LI> <LI><STRONG><A class="lia-external-url" href="https://pubs.lenovo.com/thinkagile-mx/mx_general_overview_certified_configuration_guide" target="_blank" rel="noopener">Lenovo ThinkAgile MX Certified Configuration Guides</A> - </STRONG>Microsoft-certified hardware guidance including supported server, storage, and networking configurations for Azure Local deployments.&nbsp;</LI> <LI><STRONG><A class="lia-external-url" href="https://pubs.lenovo.com/thinkagile-mx/mx_sbe" target="_blank" rel="noopener">Lenovo Solution Builder Extension (SBE)</A> </STRONG>- Support matrix, release notes, firmware and driver update guidance, and supported Azure Local versions.</LI> <LI><STRONG><A class="lia-external-url" href="https://support.lenovo.com/us/en/solutions/ht507549" target="_blank" rel="noopener">Lenovo XClarity Integrator Support Portal</A> </STRONG>- Support downloads, release notes, and lifecycle management resources for ThinkAgile MX and Azure Local solutions.</LI> </UL> <H4><STRONG>Official learning resources and community content</STRONG></H4> <H5><STRONG>Microsoft Learning &amp; docs</STRONG></H5> <UL> <LI><A class="lia-external-url" href="https://learn.microsoft.com/en-us/azure/azure-local?wt.mc_id=MVP_338345" target="_blank" rel="noopener"><STRONG>Azure Local documentation</STRONG></A> - The official docs are the <EM>authoritative source </EM>for deployment steps, architecture guidance, and runbooks. See the Azure Local docs for ESU and other operational topics. Consider using the en-us pages, receiving the timely updates.<BR /> <UL> <LI><STRONG><A class="lia-external-url" href="https://learn.microsoft.com/en-us/azure/azure-local/whats-new?wt.mc_id=MVP_338345" target="_blank" rel="noopener">What's new? - Connected Deployments</A>-</STRONG> describing changes and fixes of each releases for all supported connected scenarios.</LI> <LI><STRONG><A class="lia-external-url" href="https://learn.microsoft.com/en-us/azure/azure-local/manage/disconnected-operations-whats-new?wt.mc_id=MVP_338345" target="_blank" rel="noopener">What's new? - Disconnected Deyploments</A> </STRONG>- describing changes and fixes of each releases for all supported disconnected scenarios (ALDO, M365 etc).<BR />For both, please consider reading the respective release notes to learn more about version specific fixes and known issues.</LI> </UL> </LI> </UL> <UL> <LI><A class="lia-external-url" href="https://learn.microsoft.com/en-us/shows/azure-arc-hybrid-infrastructure-technical-event-series?wt.mc_id=MVP_338345" target="_blank" rel="noopener"><STRONG>Azure Arc-enabled Infrastructure Technical Event Series</STRONG></A> - A helpful primer on hybrid infrastructure and Azure Arc concepts; good for teams new to hybrid and Azure Local.<BR /><BR /></LI> <LI><A class="lia-external-url" href="https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-release-notes?wt.mc_id=MVP_338345" target="_blank" rel="noopener"><STRONG>Azure Arc Agent Version History</STRONG></A><STRONG> </STRONG>- What's new and changed in Azure Arc (Connected Machine Agent)?&nbsp;</LI> </UL> <P>&nbsp;</P> <UL> <LI><STRONG><SPAN data-url="https://learn.microsoft.com/en-us/shows/azure-arc-hybrid-infrastructure-technical-event-series" aria-label="https://learn.microsoft.com/en-us/shows/azure-arc-hybrid-infrastructure-technical-event-series, dadurch gelangen Sie zu learn.microsoft.com">Microsoft Learning Paths:&nbsp;</SPAN></STRONG> <UL> <LI> <P><STRONG><A class="lia-external-url" href="https://learn.microsoft.com/en-us/training/paths/azure-local-accreditation-2025/?wt.mc_id=MVP_338345" target="_blank" rel="noopener">Azure Local Accreditation 2025</A></STRONG></P> </LI> <LI> <P><STRONG><A class="lia-external-url" href="https://learn.microsoft.com/en-us/training/paths/windows-server-2025-accreditation-2026/?wt.mc_id=MVP_338345" target="_blank" rel="noopener">Windows Server 2025 and Hybrid Accreditation 2026</A></STRONG></P> </LI> <LI> <P><STRONG><A class="lia-external-url" href="https://learn.microsoft.com/en-us/training/modules/azure-local-small-form-factor/?wt.mc_id=MVP_338345" target="_blank" rel="noopener">Azure Local Small Form Factor Deployment</A></STRONG></P> </LI> </UL> </LI> <LI><STRONG>Microsoft Official Announcements </STRONG>- related to Azure Local and Azure Arc. Link:&nbsp;<A class="lia-internal-link lia-internal-url lia-internal-url-content-type-forum" href="https://techcommunity.microsoft.com/category/Azure/discussions/AzureArc/?wt.mc_id=MVP_338345" target="_blank" rel="noopener" data-lia-auto-title="Azure Arc | Microsoft Community Hub" data-lia-auto-title-active="0">Azure Arc | Microsoft Community Hub</A></LI> </UL> <H5><STRONG>Community blogs and MVP content</STRONG></H5> <P>How to find MVPs, get in touch, learn from their expierence and contribute myself in a growing community? <BR />The MVP community hub and its <STRONG>Find an MVP</STRONG> is an excellent starting point getting in touch with MVPs near you and discover their voluntary contributions to the Microsoft community, e. g. blogs with for real-world deployment stories and troubleshooting tips. <BR /><BR />Visit the Microsoft MVP site to find Azure Local and Azure Arc MVPs. Link:&nbsp;<A class="lia-external-url" href="https://mvp.microsoft.com/en-US/search?target=Profile&amp;program=MVP?wt.mc_id=MVP_338345">https://mvp.microsoft.com</A>. Find your MVP near to you using the <STRONG>country </STRONG>filter, then using the <STRONG>technology area</STRONG> "Azure Hybrid and Migrate". Please keep in mind Azure Local is an Azure product, which means other Azure services and as such other technology areas could be relevant if you'd like to connect and learn about other community contributions.</P> <img /> <P class="lia-clear-both">&nbsp;</P> <H5><STRONG>YouTube channels and demos</STRONG></H5> <UL> <LI><STRONG>Carsten Rachfahl</STRONG> - Excellent recurring topic related shows, walkthroughs and demos for Azure Stack Local and Microsoft HCI and Hybrid Infrastructure.&nbsp;<BR />Link: <A class="lia-external-url" href="https://www.youtube.com/@CarstenRachfahl" target="_blank" rel="noopener">https://www.youtube.com/@CarstenRachfahl</A><BR /><BR /></LI> <LI><STRONG>Manfred Helber - Azure Stack HCI basics video</STRONG> - Example recorded session covering fundamentals and demos. This is a about older releases of Azure Local, yet grants deeper insights and understanding about the technology.<BR />Link: <A class="lia-external-url" href="https://www.youtube.com/watch?app=desktop&amp;v=ukJ3tvTmO4c&amp;list=PL7cBl3ig-01NKNgTWtDy0KUDW_YNX50_1" target="_blank" rel="noopener">https://www.youtube.com/watch?app=desktop&amp;v=ukJ3tvTmO4c&amp;list=PL7cBl3ig-01NKNgTWtDy0KUDW_YNX50_1</A><BR /><BR /></LI> <LI> <P><STRONG>The Hybrid Friends </STRONG>- YT Channel hosted by a group of technical experts, covering different topics, including Azure Local. <BR />The content might include videos about older releases of Azure Local, yet grants deeper insights and understanding about the technology. Link: <A class="lia-external-url" href="https://www.youtube.com/@thehybridfriends/playlists" target="_blank" rel="noopener">https://www.youtube.com/@thehybridfriends/playlists</A></P> </LI> <LI><STRONG>Thomas Maurer - Microsoft Global Black Belt Team Sovereign Cloud (EMEA)</STRONG> - Thomas' Azure Local related playlist. Link:&nbsp; <P><A class="lia-external-url" href="https://www.youtube.com/watch?v=Z7UorFASe7o&amp;list=PLddMzSrepwAj1DLQg5ydUSmipzC9tI7lf" target="_blank" rel="noopener">https://www.youtube.com/watch?v=Z7UorFASe7o&amp;list=PLddMzSrepwAj1DLQg5ydUSmipzC9tI7lf</A></P> </LI> </UL> <P><STRONG>Protip for Youtube closed captions (CC) - Auto translation:</STRONG> <BR />Enable CC &gt; click on CC. Then click on Settings &gt; Subtitles &gt; Automatic Translation &gt; select your language</P> <H4><STRONG>Open communities</STRONG></H4> <P><STRONG>Azure Local Slack - News, expert discussions, voluntary community support, occasional surveys from Microsoft</STRONG></P> <UL> <LI style="list-style-type: none;"> <UL> <LI><STRONG style="color: rgb(30, 30, 30);">access request / registration: <A class="lia-external-url" href="https://aka.ms/azurelocal-slack" target="_blank" rel="noopener">https://aka.ms/azurelocal-slack</A></STRONG></LI> <LI><STRONG style="color: rgb(30, 30, 30);">server:&nbsp;</STRONG>azurelocal.slack.com</LI> </UL> </LI> </UL> <P><STRONG>LinkedIn:&nbsp;</STRONG></P> <UL> <LI><STRONG><A class="lia-external-url" href="https://www.linkedin.com/groups/12885745/" target="_blank" rel="noopener">Azure Local Tech Talk - news and discussion group</A>:&nbsp;</STRONG><BR /><BR /></LI> <LI><A class="lia-external-url" href="https://www.linkedin.com/newsletters/7501208973682040835/" target="_blank" rel="noopener"><STRONG>Azure Local Unlocked Newsletter - technical series</STRONG></A><BR /><BR /></LI> <LI><A class="lia-external-url" href="https://www.linkedin.com/newsletters/azure-local-insider-7094952705042841602/" target="_blank" rel="noopener"><STRONG>Azure Local Insider Newsletter - compact news about Azure Local</STRONG></A></LI> </UL> <P><BR />----<BR /><BR />This blogpost will be updated in the future. Community contributions are very welcome. If you are seeing noteable projects, missing links, like to add anything to the OEM section, please let me know in the comments below.<BR /><BR />Community tools - as the name says - live from contribution and feedback provided by the community. Feel invited to contribute using the GitHub repositories or provided contact options.</P> Fri, 25 Sep 2026 01:44:10 GMT https://techcommunity.microsoft.com/t5/azure-arc/blog-azure-local-tools-community-projects-microsoft-official/m-p/4559365#M1562 Karl-WE 2026-09-25T01:44:10Z https://techcommunity.microsoft.com/t5/apps-on-azure-blog/azure-container-apps-express-is-now-generally-available/ba-p/4559101 <P>For many web apps and APIs, a container image should be enough to get started. Developers should not have to choose and configure an environment before the first deployment.</P> <P>Today, <STRONG>Azure Container Apps Express</STRONG> reaches general availability. It is the fastest way to go from a container image to a production-ready app on Azure, with instant provisioning, startup optimized for sub-second performance, and scale-from-zero.</P> <P>Customers created many thousands of Express apps during public preview and told us, clearly and often, what was missing. That feedback set the priorities for general availability, and it continues to guide what comes next.</P> <img /> <H2>From container image to running app</H2> <P>Express starts with the application. Bring a container image, choose a region, add the configuration your app needs, and deploy. In the Express experience, there is no environment to stand up first. Azure provisions the underlying compute, ingress, and scaling.</P> <P>That shorter path matters when you are shipping a web app or API. It matters even more when the thing doing the shipping is an agent: AI-assisted workflows can create and update apps far faster than anyone can configure infrastructure by hand.</P> <P>Speed continues after deployment. Express apps can scale to zero when idle and are optimized for sub-second startup when traffic returns. For a measured look at that experience, <A href="https://techcommunity.microsoft.com/blog/appsonazureblog/azure-container-apps-express-for-shipping-container-apps-fast/4531371" target="_blank" rel="noopener">see Express scale from zero</A>.</P> <H2>Broad regional availability</H2> <P>At general availability, Express is available in more than 40 Azure regions, covering almost every public region where Azure Container Apps is offered. You get the same direct deployment experience while placing applications close to users and data. See the current list in the <A href="https://learn.microsoft.com/azure/container-apps/express-overview#region-availability" target="_blank" rel="noopener">Express region availability documentation</A>.</P> <H2>Built on Azure Container Apps Sandboxes</H2> <P>Azure Container Apps Express runs on <STRONG>Azure Container Apps Sandboxes</STRONG>, the isolated compute layer behind its provisioning and startup speed.</P> <P>Developers can also use Sandboxes directly to build agent platforms, secure code-execution services, and other systems that need isolated compute on demand. The <A href="https://aka.ms/aca/sandbox/launch-blog" target="_blank" rel="noopener">Azure Container Apps Sandboxes announcement</A> covers the compute platform underneath Express.</P> <H2>Where Express goes next</H2> <P>We launched Express in public preview while its focused feature set was still taking shape. That gave customers access sooner and let real usage shape the work that followed.</P> <P>Since preview, we have expanded regional availability, strengthened Express for production workloads, and added capabilities that fit its direct application model. General availability makes Express ready for production use. We will continue adding features while preserving its focus on fast, simple deployment.</P> <P>Express offers a focused subset of Azure Container Apps capabilities. Choose Express when speed and simplicity matter most. Choose a standard Container Apps environment when you need greater control over networking, GPU compute, advanced configuration, or environment-level capabilities such as Dapr.</P> <H2>Deploy your first Express app</H2> <P>Ready to try it? <A href="https://containerapps.azure.com/apps/create" target="_blank" rel="noopener">Create an Azure Container Apps Express app</A>.</P> <P>Then <A href="https://learn.microsoft.com/azure/container-apps/express-overview" target="_blank" rel="noopener">read the Express documentation</A>, <A href="https://techcommunity.microsoft.com/blog/appsonazureblog/azure-container-apps-express-for-shipping-container-apps-fast/4531371" target="_blank" rel="noopener">see Express scale from zero</A>, or <A href="https://aka.ms/aca/sandbox/launch-blog" target="_blank" rel="noopener">learn about Azure Container Apps Sandboxes</A>.</P> Wed, 23 Sep 2026 15:33:53 GMT https://techcommunity.microsoft.com/t5/apps-on-azure-blog/azure-container-apps-express-is-now-generally-available/ba-p/4559101 simonjj 2026-09-23T15:33:53Z https://techcommunity.microsoft.com/t5/apps-on-azure-blog/azure-container-apps-sandboxes-now-generally-available/ba-p/4559125 <H2>Agents Act. You Set the Limits.</H2> <P>Your platform needs to run untrusted code. Agents choose actions at runtime, from installing packages to calling APIs. In a multi-tenant service, you have to support both without letting one customer's code reach another customer's data. That requires an execution environment you control for each tenant, session, or task.</P> <P><STRONG><A class="lia-external-url" href="https://sandboxes.azure.com/" target="_blank" rel="noopener">Azure Container Apps Sandboxes</A> is that execution environment, as a service</STRONG><STRONG>.</STRONG> Each sandbox is a hardware-isolated microVM with its own Linux kernel. It starts in under a second, and you decide per sandbox what it can reach, how large it is, and how long it lives.</P> <P>&nbsp;</P> <img /> <P>&nbsp;</P> <P>For each user, controlling which <STRONG>credentials </STRONG>their agent can use and what it can reach is key. Untrusted code must stay&nbsp;<STRONG>isolated </STRONG>from other workloads and the host kernel. Preserving a <STRONG>session state</STRONG> without giving up scale to zero or instant startup is important, as is <STRONG>visibility </STRONG>into what each agent did. Let's unpack these one at a time.</P> <H2>Control What Your Agents Can Reach</H2> <P>The first question about an agent is not what it can do, but what it can reach. <STRONG>Per-sandbox egress policies</STRONG> answer that: an external proxy evaluates every outbound request against rules you set - by host, domain pattern, or CIDR.&nbsp;<STRONG>You can start with a default 'Deny' action</STRONG>&nbsp;and allow only the endpoints the task needs, so a prompt injection or a compromised dependency has nowhere to go. Network Audit shows you what was allowed and what was denied.</P> <P>Approved endpoints usually need credentials, and handing an API key to an agent means the key can be logged, echoed into a response, or carried off somewhere you did not intend.&nbsp;<STRONG>Transform rules can inject authentication headers outside the sandbox</STRONG>. The agent sends a request with no secret in it, the proxy adds the credential outside the sandbox, and the call goes through. The agent gets access to the service without ever getting the API key.</P> <P>When a static allowlist cannot express the rule you need,&nbsp;<STRONG>an egress webhook hands each request to your own service</STRONG> before it leaves. You can build a service that reviews all outbound calls, approves some and rejects others.</P> <P>Good results depend on the agent reaching the right data, and the data that matters usually sits on your private network. Outbound,&nbsp;<STRONG>VNet integration</STRONG>&nbsp;places the sandbox group on a dedicated subnet, so agents can reach internal APIs, databases, and services behind private endpoints. Egress rules are still enforced: routing is chosen per rule, so a call to an internal database is filtered, transformed, and recorded in Network Audit exactly like a call to the open internet. Inbound,&nbsp;<STRONG>a Private Endpoint brings the sandbox service into your VNet</STRONG>, so your own applications reach into your sandboxes without crossing the public internet.</P> <H2>Run Untrusted Code Without Sharing a Kernel</H2> <P>Each sandbox runs in a&nbsp;<STRONG>hardware-isolated microVM with its own Linux kernel</STRONG>&nbsp;and virtual hardware, with memory separation enforced through CPU virtualization. In contrast, typical container runtimes isolate processes while sharing the host kernel. In a sandbox, code calls into its own guest kernel, so the blast radius of a kernel exploit is one sandbox. You get that boundary with ACA Sandboxes.</P> <P>Inside that boundary, the filesystem is yours to choose. The quickest way to start is by creating a sandbox based on a&nbsp;<STRONG>platform-provided disk image:</STRONG></P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="width: 75.2778%; height: 392px; border-width: 1px;"><tbody><tr><td class="lia-align-left"> <P><STRONG>Public image</STRONG></P> </td><td class="lia-align-left"> <P><STRONG>Ready for</STRONG></P> </td></tr><tr><td class="lia-align-left"> <P>ubuntu</P> </td><td class="lia-align-left"> <P>General-purpose Linux execution and development tools</P> </td></tr><tr><td class="lia-align-left"> <P>nginx</P> </td><td class="lia-align-left"> <P>Running a web server</P> </td></tr><tr><td class="lia-align-left"> <P>copilot,&nbsp;claude</P> </td><td class="lia-align-left"> <P>GitHub Copilot CLI or Claude Code workflows</P> </td></tr><tr><td class="lia-align-left"> <P>azure-dev</P> </td><td class="lia-align-left"> <P>Azure development with CLI tools and multiple language runtimes</P> </td></tr><tr><td class="lia-align-left"> <P>python-3.12-code-interpreter</P> </td><td class="lia-align-left"> <P>Isolated Python execution through REST and MCP</P> </td></tr><tr><td class="lia-align-left"> <P>python-3.11&nbsp;to&nbsp;python-3.14</P> </td><td class="lia-align-left"> <P>Python workloads</P> </td></tr><tr><td class="lia-align-left"> <P>node-22,&nbsp;node-24</P> </td><td class="lia-align-left"> <P>Node.js workloads</P> </td></tr><tr><td class="lia-align-left"> <P>dotnet-8&nbsp;to&nbsp;dotnet-10</P> </td><td class="lia-align-left"> <P>.NET workloads</P> </td></tr><tr><td class="lia-align-left"> <P>php-8.3,&nbsp;php-8.4</P> </td><td class="lia-align-left"> <P class="">PHP-FPM workloads</P> </td></tr></tbody><colgroup><col style="width: 32.3364%" /><col style="width: 67.6013%" /></colgroup></table></DIV> <P>Availability and versions change over time, please check the portal's catalog for the current list. Images are provided as is.</P> <P>For a custom environment with your own code and dependencies,&nbsp;you can <STRONG>bring a container image from a public or private registry</STRONG>. The platform converts it into an optimized, bootable disk image containing your application, agent harness, runtimes, and toolchain. For a private registry, you authenticate with registry credentials or a managed identity for Azure Container Registry.</P> <P>You can also start from a sandbox you already have running.&nbsp;<STRONG>A disk snapshot captures the filesystem as a new disk image</STRONG>, while&nbsp;<STRONG>a memory snapshot captures disk and memory together</STRONG>, so a sandbox created from it resumes where the original left off. Installed dependencies, or a cloned repo, are set up once, and every sandbox created from the snapshot starts with them.</P> <H2>Give Every Task Its Own Sandbox</H2> <P>A sandbox starts in&nbsp;<STRONG>under a second</STRONG>, and that is why it is practical to give every task its own machine. When a machine takes minutes to come up, everything ends up sharing that same space. When it starts instantly, each task, user, or tool call runs in isolation, and gets deleted when the work is done. Thousands at a time.</P> <P>Sandboxes are sized when created by selecting a&nbsp;<STRONG>resource tier</STRONG>. These range from&nbsp;<STRONG>0.25 vCPU with 0.5 GB of memory and a 5 GB disk</STRONG>, enough for a short script or a quick evaluation, to&nbsp;<STRONG>4 vCPU with 8 GB of memory and an 80 GB disk</STRONG> for compilation and heavier analysis, with multiple steps in between. Programmatically you can go up to&nbsp;<STRONG>16 vCPU with 32 GB of memory and a 320 GB disk</STRONG>&nbsp;for the most demanding work.</P> <P>Sandboxes do not have to be discarded by hand.&nbsp;<STRONG>Lifecycle policies stop a sandbox once it goes idle</STRONG>, capturing the disk and optionally the memory. It can <STRONG>resume</STRONG> on a start command or automatically on arriving network traffic. A policy can also&nbsp;<STRONG>auto-delete</STRONG>&nbsp;a sandbox that has been stopped long enough, so abandoned work does not linger.</P> <H2>Keep State and Bring Your Data</H2> <P>Most agent tasks are short - run a script, or return a result. That is not the limit. A long-running agent needs state that outlives single runs, and&nbsp;<STRONG>volumes attach persistent storage to a sandbox at a path you choose</STRONG>. Code reads and writes to it through ordinary filesystem calls, and the data stays after the sandbox is deleted. There are three kinds:</P> <UL> <LI>A&nbsp;<STRONG>Data Disk</STRONG>&nbsp;mounts to one sandbox at a time and gives it a fast, fully POSIX-compatible filesystem on local disk, which suits a working database, a build cache, or an agent's accumulated memory.</LI> <LI>An&nbsp;<STRONG>Azure Blob volume</STRONG>&nbsp;mounts to many sandboxes at once, for sharing a large read-heavy dataset rather than supporting concurrent writers.</LI> </UL> <UL> <LI><STRONG>Azure Blob BYO</STRONG> <STRONG>volume </STRONG>(bring your own) does the same for blob storage you already own, referenced by resource ID.</LI> </UL> <H2>See What Your Sandboxes Are Doing</H2> <P>Observability is how you know what a fleet of short-lived sandboxes did. <STRONG>Telemetry is opt-in and configured per sandbox when you create it</STRONG>, and it streams out while the sandbox runs, so you can go back to a run that finished hours ago. A sandbox emits four categories of data, and you choose which of them to collect:</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="width: 83.2407%; border-width: 1px;"><tbody><tr><td> <P><STRONG>Category</STRONG></P> </td><td> <P><STRONG>What it carries</STRONG></P> </td></tr><tr><td> <P>Console logs</P> </td><td> <P>The stdout and stderr streams from each sandbox</P> </td></tr><tr><td> <P>Sandbox metrics (platform)</P> </td><td> <P>Platform-managed CPU usage, memory consumption, and network I/O per sandbox, sampled on an interval you set</P> </td></tr><tr><td> <P>OpenTelemetry</P> </td><td> <P>Signals emitted by your own application; the sandbox injects the OTLP endpoint, so an SDK you already use exports with no extra configuration</P> </td></tr><tr><td> <P>Network egress decisions</P> </td><td> <P>One record per outbound request, with the allow or deny decision the egress policy made</P> </td></tr></tbody><colgroup><col style="width: 26.9559%" /><col style="width: 73.007%" /></colgroup></table></DIV> <P>Each category is then pointed at a destination: any OTLP-compatible collector, Log Analytics through the Logs Ingestion API, or Application Insights. They mix freely, so console logs can go to your collector while egress decisions go to Log Analytics. <STRONG>&nbsp;The credential that writes to the destination never enters the sandbox.</STRONG> OTLP resolves their from a sandbox-group secret, Log Analytics authenticates with a managed identity on the group.</P> <P>Separate from what a sandbox exports, <STRONG>the platform publishes cores and memory to Azure Monitor</STRONG> on the sandbox group, and that is what the portal shows for a Sandbox group. Sandbox group totals come by default, and you can opt-in for per sandbox details if you need that level of granularity.</P> <H2>Use It From Code, a Shell, or a Browser</H2> <P>Every one of these operations is available from <STRONG>code</STRONG>, <STRONG>a shell</STRONG>, <STRONG>a template</STRONG>, or <STRONG>a browser</STRONG>, so the choice comes down to what you are doing at the time.</P> <P>When the sandbox is part of your application, use an&nbsp;<STRONG>SDK. Today available for Python and TypeScript, with .NET on the way</STRONG>. An app or service you build creates sandboxes, writes and reads files, runs commands, mounts volumes, and captures snapshots as native objects in the language you use.</P> <P>When the work is scripted,&nbsp;the<STRONG>&nbsp;ACA&nbsp;CLI </STRONG>covers the same surface from Bash or PowerShell:&nbsp;<EM><SPAN class="lia-text-color-21">aca sandbox create --disk ubuntu </SPAN></EM><SPAN class="lia-text-color-21">or </SPAN><EM>aca sandbox snapshot</EM>. Commands accept label selectors, so automation and CI act on <EM>-l name=build-agent </EM>instead of tracking generated IDs.</P> <P>When the group itself is managed in source control,&nbsp;<STRONG>define it as infrastructure as code</STRONG>. <EM>Microsoft.App/sandboxGroups</EM> is a first-class ARM resource, so a Bicep template attaches a managed identity, links a delegated VNet subnet, and assigns data-plane roles. An <A class="lia-external-url" href="https://github.com/Azure/terraform-provider-aca" target="_blank" rel="noopener">ACA Terraform provider (Preview) </A>covers the same group-level controls for teams standardized on Terraform.</P> <H2>Sandboxes portal</H2> <P>Designing a new resource type from scratch let us rethink the <A class="lia-external-url" href="https://sandboxes.azure.com/" target="_blank" rel="noopener">portal experience</A> along with it.&nbsp;<STRONG>The creation flow asks the minimal set of questions</STRONG>&nbsp;- a disk image and resource tier - and you have a running sandbox. The <STRONG>Advanced</STRONG> section allows you to go deeper to ports, volumes, lifecycle policies, egress policies, logging and more. All there when you need it.</P> <img /> <P>&nbsp;</P> <P>What you see afterward is tailored the same way. <STRONG>A sandbox group gives you the overview of all sandboxes in that group</STRONG>: how many exist and how many are running, cores and memory in use over time. The most recent sandboxes with their state and size, and the disk images and snapshots the group can build from.&nbsp;</P> <img /> <P>&nbsp;</P> <P><STRONG>A single sandbox gives you the machine</STRONG>: a terminal, live CPU, memory, storage, and network, a log stream, running processes, the files on disk, mounted volumes, and the egress traffic it generated with each request marked allowed or denied.</P> <img /> <P>&nbsp;</P> <P><STRONG>You get that same experience wherever you start.</STRONG>&nbsp;Reach sandboxes from the <A class="lia-external-url" href="https://portal.azure.com" target="_blank" rel="noopener">Azure portal</A>, alongside the rest of your resources and under the same subscriptions, RBAC, and policies, or go straight to the standalone <A class="lia-external-url" href="https://sandboxes.azure.com/" target="_blank" rel="noopener">ACA Sandboxes portal</A>. It is the same experience either way, so there is nothing to relearn and nothing you can only do in one of them.</P> <img /> <H2>How Much Does It Cost?</H2> <P>Three types of charges:</P> <UL> <LI><STRONG>vCPU</STRONG>, per core-second while the sandbox runs.</LI> <LI><STRONG>Memory</STRONG>, per GiB-second while the sandbox runs.</LI> <LI><STRONG>Storage</STRONG>, per GB stored, for as long as you keep it.</LI> </UL> <P>The resource tier of the sandbox determines the amount of vCPU and GiB of memory. These rates are on the <A class="lia-external-url" href="https://azure.microsoft.com/pricing/details/container-apps/" target="_blank" rel="noopener">Container Apps pricing page</A>.</P> <P>Storage is charged (coming soon) at <A class="lia-external-url" href="https://azure.microsoft.com/pricing/details/storage/blobs/" target="_blank" rel="noopener">Premium Azure Blob ZRS rates</A> and covers:</P> <UL> <LI><STRONG>Custom Disk Images</STRONG>, including Disk Snapshots. The platform converts your OCI container image into a bootable disk image. You pay to store one copy of that image for as long as you keep it, regardless of how many sandboxes boot from it. The OS disk each of those sandboxes runs on is not billed.</LI> <LI><STRONG>Snapshots</STRONG> are the combined memory and disk snapshots of your sandboxes, including those taken automatically when a sandbox stops.</LI> <LI>Optional <STRONG>Data Disk Volumes</STRONG> and <STRONG>Azure Blob Volumes</STRONG> that can be attached to sandboxes.</LI> </UL> <H2>Thank You and What Comes Next</H2> <P>General availability is not the destination, it is where many more of you get to start. During public preview that we announced in June 2026, the usage surpassed quickly&nbsp;<STRONG>a million sandboxes created every day</STRONG>. Our team worked closely with early customers that provided valuable feedback that shaped the product as it's today. From teams running real workloads on sandboxes ranging from cloud-native SaaS companies like <STRONG><A class="lia-internal-link lia-internal-url lia-internal-url-content-type-blog" href="https://techcommunity.microsoft.com/blog/appsonazureblog/azure-container-apps-sandboxes-preview-giving-ai-agents-a-safe-place-to-work/4545975" target="_blank" rel="noopener" data-lia-auto-title="Templafy" data-lia-auto-title-active="0">Templafy</A> </STRONG>to global organizations like&nbsp;<STRONG><A class="lia-external-url" href="https://kpmg.com/" target="_blank" rel="noopener">KPMG</A> </STRONG>and <A class="lia-external-url" href="https://www.cognite.com/en" target="_blank" rel="noopener"><STRONG>Cognite</STRONG></A>. KPMG built their Cowork AI Agent for their global workforce on ACA Sandboxes. Cognite uses ACA Sandboxes in their industrial <A class="lia-external-url" href="https://www.cognite.com/en/product/atlas" target="_blank" rel="noopener">Atlas AI system</A>. Lastly, <STRONG>the Department for Education, South Australia</STRONG> - uses ACA sandboxes to power their EdChat -&nbsp;</P> <BLOCKQUOTE> <P class="lia-indent-padding-left-30px"><SPAN data-teams="true"><STRONG>A safe place for every learner.&nbsp;</STRONG>We run the EdChat so students can learn by writing code and exploring data alongside AI, across 60,000 students and more than 40,000 staff. That model only works if every student gets an environment of their own, with clear guardrails, and can come back later to find their work exactly as they left it. Building that in house meant owning the machinery behind it. We estimate that moving to Azure Container Apps Sandboxes lets us retire close to 50,000 lines of code written to manage custom code interpreter and state ourselves. It is the per-user execution model that scales for our school system, and a lower maintenance burden for us.</SPAN></P> <P class="lia-indent-padding-left-30px"><STRONG>Cody Little</STRONG>, AI Technical Lead, Department for Education, South Australia&nbsp;</P> </BLOCKQUOTE> <P>In addition, many internal customers at Microsoft adopted ACA Sandboxes to build and enhance their products for their customers. Among those <STRONG>Microsoft Foundry&nbsp;</STRONG>built <A class="lia-external-url" href="https://learn.microsoft.com/en-us/azure/foundry/agents/concepts/hosted-agents" target="_blank" rel="noopener">hosted agents</A>, <STRONG>Copilot Studio </STRONG>hosts <A class="lia-external-url" href="https://www.microsoft.com/en-us/microsoft-365-copilot/microsoft-copilot-studio/" target="_blank" rel="noopener">agents you create</A> - both on ACA Sandboxes and – our very own&nbsp;<STRONG><A class="lia-external-url" href="https://aka.ms/aca/express/blog" target="_blank" rel="noopener">Azure Container Apps Express</A></STRONG> built a modern and fast serverless container platform on sandboxes. Their feedback and your feedback set the next priorities, and we are grateful to you for it.</P> <P>Three focus areas of work that follow:&nbsp;<STRONG>Sandbox groups get more control and visibility</STRONG>, so a platform team can observe sandboxes, audit and enforce policies at the sandbox group level. Broad extensibility with more <STRONG>SDKs </STRONG>and tighter integration with<STRONG> VS Code. </STRONG>Lastly, extensive interoperability with<STRONG> </STRONG><STRONG>Connectors and Triggers</STRONG> (now in preview) that will provide even larger customizability and on-behalf-of authentication (OBO), so agents securely reach the systems needed to do their job.</P> <H2>Next Steps</H2> <UL> <LI>Open the&nbsp;<A class="lia-external-url" href="https://sandboxes.azure.com/" target="_blank" rel="noopener">ACA Sandboxes portal</A>&nbsp;and create a group with a sandbox.</LI> <LI>Clone the&nbsp;<A class="lia-external-url" href="https://github.com/Azure-Samples/azure-container-apps-sandboxes" target="_blank" rel="noopener">samples repo</A>&nbsp;and start with the working code.</LI> <LI>Read the&nbsp;<A class="lia-external-url" href="https://sandboxes.azure.com/docs/sandboxes/" target="_blank" rel="noopener">documentation</A>&nbsp;for the quick starts and the reference behind everything above.</LI> </UL> <P>We appreciate your feedback, please submit it in the <A class="lia-external-url" href="https://sandboxes.azure.com/" target="_blank" rel="noopener">ACA Sandboxes portal</A>, or open an issue in the Azure Container Apps repo <A class="lia-external-url" href="https://github.com/microsoft/azure-container-apps/issues" target="_blank" rel="noopener">Issues · microsoft/azure-container-apps</A>.</P> Wed, 23 Sep 2026 23:33:57 GMT https://techcommunity.microsoft.com/t5/apps-on-azure-blog/azure-container-apps-sandboxes-now-generally-available/ba-p/4559125 Jan-Kalis 2026-09-23T23:33:57Z https://techcommunity.microsoft.com/t5/microsoft-discovery-blog/decoding-environmental-viromes-amplifying-human-expertise-with/ba-p/4555806 <H2 style="margin: 36px 0 14px; line-height: 1.3;">Wastewater and Community Health Monitoring</H2> <P style="margin: 0 0 18px; line-height: 1.65;">What we flush down the toilet tells an extraordinary story, not merely about individual biology, but about the collective health of our communities. A sewer network functions as a continuously updated biological sensor across an entire population catchment. As early as 1887, researchers at the <A class="lia-external-url" href="https://en.wikipedia.org/wiki/Lawrence_Experiment_Station" target="_blank" rel="noopener">Lawrence Experiment Station</A> north of Boston systematically analyzed wastewater to evaluate bacterial water quality. Over the ensuing century, environmental water sampling became a cornerstone of public health surveillance, monitoring bacterial diseases such as typhoid and viral pathogens such as <A class="lia-external-url" href="https://doi.org/10.1084/jem.71.6.765" target="_blank" rel="noopener">poliovirus</A>. More recently, wastewater surveillance provided critical early warnings during the <A class="lia-external-url" href="https://doi.org/10.1016/j.scitotenv.2023.164561" target="_blank" rel="noopener">COVID-19 pandemic</A> and is providing signals on the <A class="lia-external-url" href="https://doi.org/10.15585/mmwr.mm7502a2" target="_blank" rel="noopener">re-emergence of measles in the United States</A>.</P> <P style="margin: 0 0 18px; line-height: 1.65;">Throughout my career as an evolutionary biologist and epidemiologist, I have seen how conventional public health reporting remains constrained by healthcare-seeking behavior and clinical diagnostic access. Wastewater surveillance offers an elegant, non-invasive alternative: it captures transmission signals from symptomatic and asymptomatic individuals alike across potentially millions of residents. Historically, this surveillance required culturing specific organisms in the laboratory or deploying targeted assays designed for known targets. Today, high-throughput metagenomic sequencing captures fragments from all genetic material present in an environmental sample, enabling the detection of unexpected and emerging pathogens. For instance, wastewater metagenomics recently succeeded in identifying a <A class="lia-external-url" href="https://evidence.nejm.org/doi/full/10.1056/EVIDpha2600079" target="_blank" rel="noopener">single case of measles in Cook County, Illinois</A>, across a catchment area of over one million residents. Laboratory kits can enrich samples for broad categories of organisms of interest, allowing even viruses at a low frequency in the sample to be detected.</P> <P style="margin: 0 0 18px; line-height: 1.65;">Yet data abundance does not automatically translate into public health understanding. Metagenomic sequencing produces vast, fragmented, and noisy datasets. Sifting through billions of short genomic reads from an environmental sample and comparing them against sprawling reference databases presents formidable computational hurdles and substantial analytical friction. When interpreting signals present at a low frequency in a sample, the context has to be taken into account, as there is a risk that the sample has been contaminated during laboratory processing.</P> <P style="margin: 0 0 18px; line-height: 1.65;">This blog describes how I used the Microsoft Discovery app to accelerate public health and environmental insights from a large metagenomic study, while remaining grounded in the scientific literature and being methodical in the choice of tools and how they are coordinated to provide auditable, interpretable results.</P> <H2 style="margin: 36px 0 14px; line-height: 1.3;">The Era of Big Data and Metagenomics</H2> <P style="margin: 0 0 18px; line-height: 1.65;">To address the initial computational bottleneck of metagenomics, our team, <A class="lia-external-url" href="https://premonition.microsoft.com" target="_blank" rel="noopener">Microsoft Premonition</A>, has developed a metagenomic processing service, Premonition Insights. Insights leverages massively parallel workflows on Microsoft Azure to compare raw environmental sequences against comprehensive databases of all known organisms. It uses advanced statistical models to resolve ambiguous sequence alignments and filter taxonomic noise. In partnership with academic collaborators, Insights has been applied across diverse biological samples, including <A class="lia-external-url" href="https://doi.org/10.1038/s41467-023-40247-4" target="_blank" rel="noopener">human blood</A>, <A class="lia-external-url" href="https://doi.org/10.1038/s42003-024-06337-9" target="_blank" rel="noopener">mosquitoes</A>, <A class="lia-external-url" href="https://doi.org/10.1093/ve/veag032" target="_blank" rel="noopener">rodents</A>, and <A class="lia-external-url" href="https://doi.org/10.1016/j.virusres.2023.199174" target="_blank" rel="noopener">bats</A>.</P> <P style="margin: 0 0 18px; line-height: 1.65;">However, even after cloud services process terabytes of FASTQ files into structured taxonomic tables, the human expert faces a secondary, laborious bottleneck: exploratory scientific interpretation. In the case study discussed below, Premonition Insights distilled raw environmental sequencing data into a 6 GB table containing approximately 7.5 million candidate matches across hundreds of samples, each annotated with taxonomic lineages, probabilistic match scores, coverage statistics, sample dates, and collection locations.</P> <P style="margin: 0 0 18px; line-height: 1.65;">As any computational biologist knows, turning a 7.5-million-row table into defensible epidemiological insights normally requires substantial manual effort. A researcher must write custom data-wrangling scripts, resolve Python and R environment dependencies, query external environmental and meteorological APIs, configure specialized command-line phylogenetic software, filter false positives, and construct visualizations to inspect patterns. This friction often fragments an expert's focus across software engineering and data plumbing rather than epidemiological reasoning.</P> <H2 style="margin: 36px 0 14px; line-height: 1.3;">Accelerating Insights with Domain Expertise and AI Agents</H2> <P style="margin: 0 0 18px; line-height: 1.65;">To streamline this exploratory phase, I utilized the&nbsp;<A class="lia-external-url" href="https://github.com/microsoft/discovery" target="_blank" rel="noopener">Microsoft Discovery app</A>, a localized experience of the Microsoft Discovery platform that enables domain experts to configure and orchestrate collaborating AI agents across complex scientific workflows. Crucially, the Discovery app, as well as the cloud-based platform, is not designed to replace human judgment or automate epidemiological conclusions. Environmental metagenomics is too nuanced and sensitive for autonomous “black box” automation; it demands subject-matter expertise to help distinguish authentic biological signal from sequence artifacts, sample contamination, and environmental background noise, and to suggest further confirmatory laboratory and epidemiological analyses.</P> <P style="margin: 0 0 18px; line-height: 1.65;">Working with Discovery requires meaningful scientific steering. The platform has real but useful friction: curating the <A class="lia-external-url" href="https://learn.microsoft.com/en-us/azure/microsoft-discovery/concept-bookshelf-knowledge-bases" target="_blank" rel="noopener">Scientific Bookshelf</A>, looking over agent tasks, getting the evaluation rubrics right, and knowing what assumptions and trade-offs were made at critical analytical junctures. As a domain expert, my role was to formulate the epidemiological hypotheses, curate relevant wastewater virology literature, establish quality rubrics, and critically evaluate intermediate outputs. Meanwhile, Discovery's collaborating agents assisted with data preparation, environment configuration, code synthesis, API integration, and interactive visualization. As a consequence of working with Discovery, you can generate documentation of how you work, interpret data, use your favorite tools, and more. Capturing this know-how is especially important when working in large collaborative teams, for reproducibility, as well as for training and educational purposes.</P> <P style="margin: 0 0 18px; line-height: 1.65;">Using the Discovery app, I completed an exploratory analysis workflow. Agents assisted with data preparation, software setup, visualization, and hypothesis generation, while I remained responsible for scientific interpretation and conclusions. After familiarizing myself with the platform, I estimate that it took me less than half a day, most of which was spent setting up the workflow and reviewing the outputs. This substantial reduction in manual analysis effort demonstrated how agentic assistance can amplify domain expertise across multidisciplinary tasks, as well as turn interactive scientific inquiry into a structured set of tasks leading to outcomes.</P> <H2 style="margin: 36px 0 14px; line-height: 1.3;">Scenario Deep Dive: Environmental Viromes in Gujarat, India</H2> <P style="margin: 0 0 18px; line-height: 1.65;">To evaluate this collaborative workflow on a real-world dataset, I examined publicly available environmental surveillance sequencing data from Gujarat, India (<A class="lia-external-url" href="https://www.ncbi.nlm.nih.gov/bioproject/?term=PRJEB102331" target="_blank" rel="noopener">BioProject PRJEB102331</A>), originally <A class="lia-external-url" href="https://www.nature.com/articles/s44454-026-00035-3" target="_blank" rel="noopener">collected and published by regional researchers</A>. This is a large, high-quality metagenomic dataset, with over 500 wastewater samples gathered from four cities over the course of a year, with separate processing of RNA and DNA to generate over 1,000 sequencing libraries, with enrichment for viruses. My analytical objective was to characterize the prevalence and seasonal dynamics of waterborne enteric viruses that cause gastrointestinal illness.</P> <P style="margin: 0 0 18px; line-height: 1.65;">Within the Discovery app, the exploratory investigation unfolded across five interconnected analytical stages:</P> <OL style="margin: 0 0 18px 24px; padding-left: 18px; line-height: 1.65;"> <LI><STRONG>Literature Context &amp; Bookshelf Setup:</STRONG> I seeded Discovery's Scientific Bookshelf with peer-reviewed publications on wastewater epidemiology, enterovirus taxonomy, and local hydrological surveillance. This gave the agents grounding in the domain to help the subsequent code generation and anchor the terminology used. To blind the analysis to the conclusions of the original study, the scientific manuscript describing the study was omitted from the Bookshelf, helping to ensure that the AI agents operating within Discovery were not simply taking a shortcut and copying and pasting results.</LI> <LI><STRONG>Data Preparation &amp; Taxonomic Filtering:</STRONG> I directed the agents to parse the 7.5-million-row Premonition Insights summary table. Guided by explicit rubrics and domain filtering criteria, the agents wrote Python routines to isolate matches corresponding to recognized genera of gastrointestinal and waterborne viruses.</LI> <LI><STRONG>Meteorological Data Integration:</STRONG> To investigate climatic drivers of viral presence, the agents connected to the external <A class="lia-external-url" href="https://open-meteo.com/" target="_blank" rel="noopener">Open-Meteo API</A>, programmatically retrieving historical daily rainfall and temperature records corresponding to the geographic coordinates and sampling dates in Gujarat.</LI> <LI><STRONG>Comparative Environmental Dynamics:</STRONG> The agents synthesized the genomic and meteorological datasets, generating comparative statistical summaries.</LI> <LI><STRONG>Bioinformatics, Phylogenetics &amp; Dynamic Visualization:</STRONG> To evaluate whether detected enterovirus sequences represented circulating field strains or taxonomic ambiguities, the agents configured local bioinformatics tools, aligned sample consensus sequences against reference enterovirus genomes, and built phylogenetic trees. Like most scientists working with bioinformatics pipelines, I have my own favorite tools to use, such as <A class="lia-external-url" href="https://mafft.cbrc.jp/alignment/software/" target="_blank" rel="noopener">MAFFT</A> for sequence alignment and <A class="lia-external-url" href="https://iqtree.github.io" target="_blank" rel="noopener">IQ-TREE</A> for reconstructing trees (although other great tools are available). I asked the agents to build pipelines around those tools. In addition to static charts, the agents generated dynamic HTML dashboards incorporating interactive visual components using&nbsp;<A class="lia-external-url" href="https://github.com/owebeeone/jowna" target="_blank" rel="noopener">Jowna</A>, <A class="lia-external-url" href="https://plotly.com/" target="_blank" rel="noopener">Plotly.js</A>, and <A class="lia-external-url" href="https://doi.org/10.1186/s12859-018-2283-2" target="_blank" rel="noopener">phylotree.js</A>, enabling immediate visual inspection of temporal trends and evolutionary branching.</LI> </OL> <P style="margin: 0 0 18px; line-height: 1.65;">Through an interactive chat with the app, I created a list of tasks, each leading to a separate outcome. For each of these outcomes, the app helped to create a rubric to identify specific criteria for accuracy and robustness, as well as graders to assess whether the generated outcomes met those criteria.</P> <img><STRONG>Figure 1.</STRONG> Widgets illustrating the tasks involved in the wastewater analysis and the generated outcomes. These can be directly input into the widget or may emerge during unstructured, interactive chats.</img> <H2 style="margin: 36px 0 14px; line-height: 1.3;">Collaborative Breakdown of the Exploratory Workflow</H2> <DIV style="width: 100%; max-width: 1000px; margin: 28px auto; overflow-x: auto; border: 0.25px solid #d8dce6; border-radius: 10px; box-shadow: 0 4px 14px rgba(0, 0, 0, 0.08); box-sizing: border-box;"> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="width: 100%; border-width: 1px; border-spacing: 0;"><thead><tr><th class="lia-background-color-custom-1e8bbc lia-vertical-align-middle" scope="col" style="padding: 14px;">Workflow Phase</th><th class="lia-background-color-custom-1e8bbc lia-vertical-align-middle" scope="col" style="padding: 14px;">Domain Expert Role</th><th class="lia-background-color-custom-1e8bbc lia-vertical-align-middle" scope="col" style="padding: 14px;">Discovery Agent Role</th><th class="lia-background-color-custom-1e8bbc lia-vertical-align-middle" scope="col" style="padding: 14px;">Tools &amp; Artifacts</th></tr></thead><tbody><tr><th class="lia-background-color-custom-eef3fb lia-vertical-align-top" scope="row" style="padding: 15px;">Literature &amp;<BR />Context Setup</th><td class="lia-background-color-22 lia-vertical-align-top" style="padding: 15px;">Curated wastewater virology papers, established the analysis scope, and set quality rubrics.</td><td class="lia-background-color-22 lia-vertical-align-top" style="padding: 15px;">Indexed papers in the Scientific Bookshelf and extracted relevant domain parameters and terminology.</td><td class="lia-background-color-22 lia-vertical-align-top" style="padding: 15px;"><SPAN style="display: inline-block; max-width: 100%; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #e8e5ff; color: #4f3f8f; border-radius: 12px; font-size: 12px; font-weight: 600; box-sizing: border-box; overflow-wrap: anywhere;">Scientific Bookshelf</SPAN> <SPAN style="display: inline-block; max-width: 100%; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #e8e5ff; color: #4f3f8f; border-radius: 12px; font-size: 12px; font-weight: 600; box-sizing: border-box; overflow-wrap: anywhere;">Markdown rubrics</SPAN></td></tr><tr><th class="lia-background-color-custom-e4edf9 lia-vertical-align-top" scope="row" style="padding: 15px;">Data Extraction<BR />&amp; Filtering</th><td class="lia-background-color-custom-f8f9fc lia-vertical-align-top" style="padding: 15px;">Specified virus families of interest and defined filtering thresholds.</td><td class="lia-background-color-custom-f8f9fc lia-vertical-align-top" style="padding: 15px;">Wrote and executed data-wrangling scripts to reduce the 7.5-million-row table to target viral genera.</td><td class="lia-background-color-custom-f8f9fc lia-vertical-align-top" style="padding: 15px;"><SPAN style="display: inline-block; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #e1f3ed; color: #176b57; border-radius: 12px; font-size: 12px; font-weight: 600;">Python</SPAN> <SPAN style="display: inline-block; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #e1f3ed; color: #176b57; border-radius: 12px; font-size: 12px; font-weight: 600;">Pandas</SPAN> <SPAN style="display: inline-block; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #e1f3ed; color: #176b57; border-radius: 12px; font-size: 12px; font-weight: 600;">Polars</SPAN></td></tr><tr><th class="lia-background-color-custom-eef3fb lia-vertical-align-top" scope="row" style="padding: 15px;">Meteorological Integration</th><td class="lia-background-color-22 lia-vertical-align-top" style="padding: 15px;">Hypothesized seasonal and monsoon drivers and identified the required weather metrics.</td><td class="lia-background-color-22 lia-vertical-align-top" style="padding: 15px;">Constructed an API client, retrieved historical rainfall and temperature data for Gujarat, and merged the environmental and genomic datasets.</td><td class="lia-background-color-22 lia-vertical-align-top" style="padding: 15px;"><SPAN style="display: inline-block; max-width: 100%; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #fff0d9; color: #8a4b08; border-radius: 12px; font-size: 12px; font-weight: 600; overflow-wrap: anywhere;">Open-Meteo API</SPAN> <SPAN style="display: inline-block; max-width: 100%; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #fff0d9; color: #8a4b08; border-radius: 12px; font-size: 12px; font-weight: 600; overflow-wrap: anywhere;">Geo-merging</SPAN></td></tr><tr><th class="lia-background-color-custom-e4edf9 lia-vertical-align-top" scope="row" style="padding: 15px;">Bioinformatics<BR />&amp; Phylogenetics</th><td class="lia-background-color-custom-f8f9fc lia-vertical-align-top" style="padding: 15px;">Formulated an enterovirus verification plan and inspected tree topologies for biological plausibility.</td><td class="lia-background-color-custom-f8f9fc lia-vertical-align-top" style="padding: 15px;">Installed local sequence-alignment and tree-building tools and constructed phylogenetic trees against GenBank references.</td><td class="lia-background-color-custom-f8f9fc lia-vertical-align-top" style="padding: 15px;"><SPAN style="display: inline-block; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #f2e5f5; color: #713878; border-radius: 12px; font-size: 12px; font-weight: 600;">MAFFT</SPAN> <SPAN style="display: inline-block; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #f2e5f5; color: #713878; border-radius: 12px; font-size: 12px; font-weight: 600;">IQ-TREE</SPAN> <SPAN style="display: inline-block; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #f2e5f5; color: #713878; border-radius: 12px; font-size: 12px; font-weight: 600;">GenBank</SPAN></td></tr><tr><th class="lia-background-color-custom-eef3fb lia-vertical-align-top" scope="row" style="padding: 15px;">Dashboard &amp;<BR />Visualization</th><td class="lia-background-color-22 lia-vertical-align-top" style="padding: 15px;">Evaluated visual outputs, checked outlier points, and verified spatial patterns between drain and river samples.</td><td class="lia-background-color-22 lia-vertical-align-top" style="padding: 15px;">Created a responsive web dashboard with synchronized time-series charts and an interactive phylogenetic tree viewer.</td><td class="lia-background-color-22 lia-vertical-align-top" style="padding: 15px;"><SPAN style="display: inline-block; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #e3f1fa; color: #185f86; border-radius: 12px; font-size: 12px; font-weight: 600;">Jowna</SPAN> <SPAN style="display: inline-block; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #e3f1fa; color: #185f86; border-radius: 12px; font-size: 12px; font-weight: 600;">Plotly.js</SPAN> <SPAN style="display: inline-block; max-width: 100%; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #e3f1fa; color: #185f86; border-radius: 12px; font-size: 12px; font-weight: 600; overflow-wrap: anywhere;">phylotree.js</SPAN> <SPAN style="display: inline-block; margin: 0 4px 6px 0; padding: 4px 8px; background-color: #e3f1fa; color: #185f86; border-radius: 12px; font-size: 12px; font-weight: 600;">HTML5</SPAN></td></tr></tbody><colgroup><col style="width: 25.00%" /><col style="width: 25.00%" /><col style="width: 25.00%" /><col style="width: 25.00%" /></colgroup></table></DIV> </DIV> <H2 style="margin: 36px 0 14px; line-height: 1.3;">Defensible Scientific Findings and Responsible Interpretation</H2> <P style="margin: 0 0 18px; line-height: 1.65;">The exploratory analysis revealed compelling biological patterns across the environmental dataset. Across the waterborne viral genera identified, rotavirus and adenovirus exhibited the highest relative abundance and widespread persistence across sampling sites (Figure 1). Both pathogens represent major contributors to pediatric gastrointestinal illness globally and regionally. When temporal signals were correlated with meteorological data, multiple enteric viruses, such as norovirus, displayed pronounced abundance peaks in September, aligning with the late portion of the regional monsoon season, which runs from June through September (Figure 2).</P> <img><STRONG>Figure 2.</STRONG> Counts of contiguous sequences (“contigs”) generated by assembling short reads that matched common gastrointestinal viruses.</img> <P>&nbsp;</P> <img><STRONG>Figure 3.</STRONG> Dynamics over time of common gastrointestinal viruses.</img> <P style="margin: 0 0 18px; line-height: 1.65;">A critical test of the workflow arose regarding enteroviruses and poliovirus. The automated taxonomic scan detected low background levels of non-polio enteroviruses, which were subsequently verified through agent-generated phylogenetic trees comparing sample sequences against reference viral genomes (Figure 4). Of particular interest are the closely related clusters of sequences, which may represent a local outbreak and suggest the need for further epidemiological investigation. However, no poliovirus was detected in these samples. This finding is consistent with successful regional control efforts, although additional epidemiological evidence would be required to assess specific drivers.</P> <img><STRONG>Figure 4.</STRONG> Phylogeny of sequences corresponding to enteroviruses identified in the samples.</img> <P>&nbsp;</P> <P style="margin: 0 0 18px; line-height: 1.65;">One of the stated advantages of metagenomics is the ability to detect unexpected signals that may be overlooked by targeted approaches. For example, two separate samples from two cities in July 2024 were positive for Chandipura virus, a rare but virulent vector-borne virus thought to be mainly spread by sandflies. This raises the question of whether this is a real signal. The fact that two samples were positive from different cities makes it less likely that this was due to contamination. That the samples were taken in July 2024, when sandflies are active, and that&nbsp;<A class="lia-external-url" href="https://www.who.int/emergencies/disease-outbreak-news/item/2024-DON529" target="_blank" rel="noopener">a large outbreak of Chandipura virus was reported in Gujarat at the time</A> lends further support to this being a real signal.</P> <P style="margin: 0 0 18px; line-height: 1.65;">The enterovirus and Chandipura virus examples highlight the importance of humans in evidence synthesis in AI-assisted workflows. The Discovery platform makes it easier to integrate multiple datasets and helps to contextualize the results, but, as is typical with scientific workflows, more questions are raised than answered. For example, how much poliovirus transmission could be occurring without it being observed in wastewater? <A class="lia-external-url" href="https://doi.org/10.64898/2026.09.16.26363050" target="_blank" rel="noopener">Mathematical models</A> can help us think about this more deeply. Are the matches to Chandipura virus real? While the circumstantial evidence surrounding the epidemiological context may be convincing, an independent laboratory analysis of the positive samples to generate full genomes of these viruses would lend further biological evidence. The “lab-in-the-loop” is becoming an important paradigm for scientific discovery, integrating human domain expertise, AI automation, and wet-lab biology.</P> <DIV style="margin: 24px 0; padding: 16px 18px; border-left: 4px solid #5b5fc7; background-color: #f5f5f5; line-height: 1.65;"><STRONG>Responsible Research &amp; Methodology Notice:</STRONG> The work presented here focused exclusively on the computational interpretation of publicly available environmental sequencing data (<A class="lia-external-url" href="https://www.ncbi.nlm.nih.gov/bioproject/?term=PRJEB102331" target="_blank" rel="noopener">BioProject PRJEB102331</A>) and did not involve the creation, modification, or optimization of biological agents or pathogens. The exploratory workflows operated within a local computational environment with full human oversight at every stage.</DIV> <H2 style="margin: 36px 0 14px; line-height: 1.3;">Horizontal Capability: Empowering the Scientist at the Frontier</H2> <P style="margin: 0 0 18px; line-height: 1.65;">What makes this investigation compelling is not solely the specific viral dynamics observed in Gujarat, but what it reveals about a horizontal capability for scientific discovery. In conventional workflows, the sheer friction of software engineering creates substantial drag on exploratory research.</P> <P style="margin: 0 0 18px; line-height: 1.65;">The Microsoft Discovery app addressed this friction by serving as a multidisciplinary accelerator. Importantly, this success rests on a clear separation of concerns:</P> <UL> <LI><STRONG>Platform Capabilities:</STRONG> Discovery managed multi-agent coordination, contextual retrieval from the Scientific Bookshelf, safe local code generation, and visualization assembly.</LI> <LI><STRONG>Custom Workflow Engineering:</STRONG> Modular scripts and API integrations were synthesized specifically for the dataset's unique schema, metadata, and bioinformatics requirements.</LI> <LI><STRONG>Human Domain Judgment:</STRONG> As the scientist, I formulated the questions, curated the literature, defined analytical constraints, reviewed assumptions, and interpreted the results within established epidemiological principles.</LI> </UL> <P style="margin: 0 0 18px; line-height: 1.65;">To ensure full scientific transparency and reproducibility, the software versions, analytical prompts, rubrics, and workflow scripts utilized throughout this exploration are stored within a structured workspace generated by the Discovery app. This ensures that peer researchers can inspect, evaluate, and reproduce the agent-assisted workflow on comparable metagenomic datasets.</P> <P style="margin: 0 0 18px; line-height: 1.65;">At a moment when public health challenges demand rapid responsiveness while preserving accountability, and biological datasets grow exponentially, agent-assisted exploratory platforms offer a transformative path forward. By handling mechanical data wrangling while keeping domain experts firmly in command, Discovery enables scientists to spend more time doing what matters most: generating defensible insights that protect human communities.</P> <SECTION style="width: 100%; max-width: 1000px; margin: 44px auto 24px; box-sizing: border-box;"> <DIV style="padding: 28px 30px; background-color: #f4f9fc; border: 1px solid #cfe4ee; border-left: 6px solid #1E8BBC; border-radius: 10px; box-shadow: 0 4px 14px rgba(0, 0, 0, 0.07); box-sizing: border-box;"> <H2 style="margin: 0 0 16px; color: #1e8bbc; font-family: 'Segoe UI', Arial, sans-serif; font-size: 24px; font-weight: 600; line-height: 1.3;">About the Author</H2> <P style="margin: 0 0 8px; color: #242424; font-family: 'Segoe UI', Arial, sans-serif; font-size: 18px; font-weight: bold; line-height: 1.4;">Simon Frost</P> <P class="lia-align-left" style="margin: 0; color: #323130; font-family: 'Segoe UI', Arial, sans-serif; font-size: 16px; font-weight: 400; line-height: 1.7;">Simon Frost is a Principal Scientist at Microsoft Discovery &amp; Quantum and Microsoft Premonition, and Professor of Pathogen Dynamics at the London School of Hygiene &amp; Tropical Medicine. He holds an Sc.D. from the University of Cambridge and a D.Phil. in Mathematical Biology from the University of Oxford. With over 25 years of research in infectious disease dynamics, viral genomics, and molecular epidemiology, his work focuses on integrating real-time biological data with computational and AI models to enhance our understanding of the emergence and spread of global pathogens.</P> </DIV> </SECTION> Wed, 23 Sep 2026 13:59:06 GMT https://techcommunity.microsoft.com/t5/microsoft-discovery-blog/decoding-environmental-viromes-amplifying-human-expertise-with/ba-p/4555806 sdwfrost 2026-09-23T13:59:06Z https://techcommunity.microsoft.com/t5/azure/microsoft-entra-connect-sync-will-stop-working-on-september-30/m-p/4559241#M22874 <P>Hello,</P><P>&nbsp;</P><P>Due to Microsoft's announcement that Microsoft Entra Connect Sync will stop working on September 30, 2026 if the installed version is below 2.5.79.0, we would like to know whether the other related components will also be affected.</P><P>&nbsp;</P><P>We are currently running Microsoft Entra Connect Sync version 2.6.3.0, which was confirmed by a Microsoft engineer to be unaffected by this change.</P><P>&nbsp;</P><P>However, we also have the components listed below, and we would like to confirm whether they will be affected as well:</P><DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN">&nbsp;</DIV> Wed, 23 Sep 2026 09:03:02 GMT https://techcommunity.microsoft.com/t5/azure/microsoft-entra-connect-sync-will-stop-working-on-september-30/m-p/4559241#M22874 MasPAN74 2026-09-23T09:03:02Z https://techcommunity.microsoft.com/t5/microsoft-developer-community/microsoft-foundry-hosted-agents-and-mcp-in-practice-building/ba-p/4557526 <P>An agent can produce a convincing answer while the system around it is still difficult to deploy, authorize, debug, and recover. For AI engineers and developers, that is often the real gap between a promising prototype and an application people can depend on.</P> <P>Fibey Field Ops makes that gap concrete. It is a synthetic fiber-operations assistant built with Microsoft Foundry Hosted Agents, Model Context Protocol (MCP), and Azure Container Apps. This walkthrough follows one field-service task through the implementation, then examines the deployment and operational decisions behind it.</P> <H2 id="introduction-the-application-is-more-than-the-model">Introduction: the application is more than the model</H2> <P>Imagine a technician preparing a fiber work order. Before leaving the depot, they need the job details, available parts, relevant procedures, and network status. Those facts belong to different systems. A useful assistant must retrieve them, combine them, and explain what is missing without inventing an answer.</P> <P>The challenge is not simply selecting a capable model. It is establishing reliable contracts between the model, its tools, the hosting platform, and the application. Fibey demonstrates those contracts with <STRONG>one hosted agent, five instruction skills, eleven operational tools, and five supporting Container Apps</STRONG>.</P> <P>There is an important qualification: Fibey is a protected, synthetic-data demonstration, not a production-ready field-service system. Its gateway mappings and work orders remain in memory, and it does not enforce per-user session ownership or approval of operational writes. Those limitations are useful teaching material rather than details to hide.</P> <P>The <A href="https://github.com/leestott/fibey-toolbox-demo" target="_blank" rel="noopener">Fibey repository</A> contains the implementation, infrastructure, documentation, and presentation deck. Repository access depends on its permissions.</P> <H2 id="1-separate-reasoning-instructions-and-tool-execution">1. Separate reasoning, instructions, and tool execution</H2> <P>MCP is a standard interface for discovering and invoking tools. In Fibey, the agent connects to one Microsoft Foundry Toolbox MCP endpoint. The toolbox exposes capabilities backed by an inventory MCP server, a work-orders OpenAPI service, and a Search knowledge base.</P> <P>That common interface does not make the underlying systems identical. OpenAPI still describes an HTTP API, inventory still implements MCP, and knowledge retrieval still depends on indexed documents. The toolbox centralizes the agent-facing integration and connection configuration while preserving those implementation choices.</P> <P>Four terms describe different responsibilities:</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><thead><tr><th>Concept</th><th>Responsibility in Fibey</th></tr></thead><tbody><tr><td>Agent</td><td>Classifies the request, loads instructions, selects tools, and constructs the response</td></tr><tr><td>Skill</td><td>An instruction document for a task such as inventory lookup or field briefing</td></tr><tr><td>Tool</td><td>An operation with an advertised input schema and a result</td></tr><tr><td>Toolbox</td><td>The curated MCP surface and references to downstream connections</td></tr></tbody><colgroup><col style="width: 50.00%" /><col style="width: 50.00%" /></colgroup></table></DIV> <P>Fibey's five skills cover inventory lookup, work-order management, knowledge retrieval, work-order preparation, and field briefings. The last two coordinate several tools; they do not create additional agents.</P> <P>The configured toolbox exposes eleven operational tools directly: six inventory/status operations, four work-order operations, and one knowledge-retrieval operation. The agent uses their actual names and schemas. Discovery wrappers such as <CODE>tool_search</CODE> and <CODE>call_tool</CODE> are relevant only when a toolbox exposes them; they are not mandatory steps before every call.</P> <P>This distinction matters when debugging. A missing wrapper is not necessarily a broken integration. A skill mentioning a capability is also not proof that the runtime can invoke it. The current tool schema is the executable contract.</P> <H2 id="2-follow-the-hosted-azure-architecture">2. Follow the hosted Azure architecture</H2> <P>Microsoft Foundry hosts the agent container and exposes its endpoint. Azure Container Apps (ACA) hosts the application services around it. The deployment source of truth is <CODE>azure.yaml</CODE>, which declares the GPT-5.4-mini model deployment and the hosted agent's Responses <CODE>2.0.0</CODE> protocol.</P> <P>The design keeps the browser-facing application separate from agent execution and backend integration. That makes it easier to inspect each boundary, but it does not make the whole deployment private or remove the need for application authorization.</P> <P>Treat GPT-5.4-mini as the sample's configured baseline, not a claim that it is optimal for every workload. When evaluating another model, measure tool-selection accuracy, schema compliance, grounded answers, latency, and cost per completed task rather than choosing from a fluent demo response alone.</P> <img /> <P>The&nbsp;<A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/docs/architecture.md" target="_blank" rel="noopener">engineering architecture</A> expands this presentation view with resource ownership, identities, configuration, and telemetry paths.</P> <H3 id="the-application-request-path">The application request path</H3> <P>The browser signs in through Microsoft Entra ID at the UI's ACA authentication boundary. An explicit allowlist restricts access to the intended user. Nginx serves the React application and proxies chat requests to the internal FastAPI gateway.</P> <P>The gateway invokes the Foundry-hosted agent using its managed identity. Server-sent events (SSE), a streaming HTTP format, carry answer text, tool activity, citations, failures, and completion back to the UI.</P> <P>Gateway and dashboard ingress are internal to the ACA environment. Inventory and work orders have external ingress so the toolbox can reach them, but their operational endpoints require separate API keys. External accessibility is not anonymous access, and internal ingress is not a complete network-isolation strategy.</P> <H3 id="the-knowledge-and-status-paths">The knowledge and status paths</H3> <P>The knowledge pipeline starts with eight Markdown documents in the repository. A setup script uploads them to a private Blob Storage container, configures a Search data source and indexer, verifies ingestion, and creates the knowledge source and knowledge base used by Foundry IQ.</P> <P>This is not an embedding pipeline assembled implicitly by the chat application. The current configuration uses minimal reasoning and extractive retrieval, with defaults of three output documents and 6,000 output tokens. Its knowledge-base configuration and MCP endpoint use preview APIs, which need lifecycle and support review before production adoption.</P> <P>Network status takes a different path. Inventory's <CODE>get_network_status</CODE> tool reads the configured internal HTML dashboard. It is a narrow HTTP fetch, not browser automation, arbitrary website navigation, or a real operational clearance.</P> <P>Azure Container Registry supplies container images. ACA logs go to Log Analytics. Hosted code enables OpenTelemetry, the standard instrumentation framework for traces and metrics, but the repository does not provision Application Insights. The project's linked trace destination must be configured and verified separately.</P> <H2 id="3-trace-a-work-order-briefing-through-the-implementation">3. Trace a work-order briefing through the implementation</H2> <P>The most useful demonstration starts with one concrete request: prepare a technician for a job. The <CODE>field-briefing</CODE> skill provides the instructions for combining work-order data, inventory, procedures, and status without pretending that one backend contains everything.</P> <P>Use a request such as the following in a prepared synthetic environment. The exact wording and tool order may vary; the important evidence is which operations succeeded and which facts support the answer.</P> <BLOCKQUOTE> <P>Brief me on WO-007, including stock, relevant procedures, safety, and network status.</P> </BLOCKQUOTE> <P>The intended flow is:</P> <OL> <LI>Load the field-briefing instructions and retrieve WO-007.</LI> <LI>Identify required parts and use a batch stock check when several parts need checking.</LI> <LI>Combine procedure and safety questions into one focused knowledge retrieval.</LI> <LI>Read the configured synthetic status dashboard through inventory MCP.</LI> <LI>Produce a briefing grounded in successful results, with source references and explicit gaps.</LI> </OL> <P>Batching is a useful engineering choice, not a claim of a measured performance improvement. One batch stock call avoids unnecessary repeated requests. Combining related retrieval questions can also reduce duplicate context and tool traffic.</P> <img /> <P>&nbsp;</P> <P>This screenshot was captured from an authenticated deployment. The displayed briefing identifies an unavailable connector kit and available test equipment. It illustrates a specific synthetic response, not current stock or a benchmark.</P> <H3 id="use-the-supported-hosted-integration">Use the supported hosted integration</H3> <P>The relevant implementation is <A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/src/fibey/agent/hosted.py" target="_blank" rel="noopener">the hosted entrypoint</A>. It uses <CODE>FoundryToolbox</CODE> from <CODE>agent_framework_foundry_hosting</CODE>, a <CODE>FoundryChatClient</CODE>, a skills provider, and <CODE>ResponsesHostServer.run_async()</CODE>.</P> <P>The hosting helper does more than attach a bearer token. It authenticates MCP requests and forwards the hosted runtime's per-request call ID. Replacing it with a generic transport can lose context that the platform expects. The entrypoint also closes credentials and clients when execution exits.</P> <P>Hosted skill discovery prefers published skills when available and retains bundled instructions as a fallback in <CODE>auto</CODE> mode. Explicit <CODE>mcp</CODE> mode fails if published skills cannot be loaded; <CODE>file</CODE> mode uses the bundled documents. This makes the fallback intentional rather than silently running without the task instructions.</P> <H3 id="distinguish-history-from-compute-affinity">Distinguish history from compute affinity</H3> <P>The gateway maintains two hosted mappings. <CODE>previous_response_id</CODE> links conversation history, while <CODE>agent_session_id</CODE> preserves affinity to the hosted compute session. Losing one is not equivalent to losing the other.</P> <P>Both mappings are held in gateway memory, which is why it remains at one replica. A UUID (universally unique identifier) is a conversation handle, not proof of ownership. Reset clears the local mappings but does not reset work orders or delete the old remote compute session.</P> <P>There is also a privacy distinction between storage and telemetry. Gateway requests use stored Responses history, while the agent's model-call options use <CODE>store: false</CODE>. Sensitive tracing being disabled does not mean all conversation persistence is disabled.</P> <H2 id="4-run-locally-without-confusing-development-and-cloud-boundaries">4. Run locally without confusing development and cloud boundaries</H2> <P>Local development is useful for inspecting the gateway and agent without rebuilding the hosted image. It still calls a real Foundry project, model, and toolbox. It is not an offline simulation, and tool writes can affect the configured synthetic backend.</P> <P>Use Python 3.12+, uv, Node.js 24 LTS, and an authorized Azure developer identity. The commands below run from the repository root in PowerShell. Keep the existing dependency locks and copy <CODE>.env.example</CODE> only when creating a new local configuration.</P> <LI-CODE lang="">uv sync --frozen Copy-Item .env.example .env</LI-CODE> <P>Set <CODE>FOUNDRY_PROJECT_ENDPOINT</CODE>, <CODE>FOUNDRY_MODEL</CODE>, and <CODE>TOOLBOX_MCP_URL</CODE> in the ignored <CODE>.env</CODE>. Use your environment's actual values. Backend API keys belong in Foundry connections, not in the browser or prompts.</P> <P>Start the gateway:</P> <LI-CODE lang="">az login uv run --frozen uvicorn fibey.gateway.api_server:app --host 127.0.0.1 --port 8080</LI-CODE> <P>In another terminal, start the UI:</P> <LI-CODE lang="">Set-Location ui npm ci npm run dev</LI-CODE> <P>Open <CODE>http://localhost:5173</CODE>. Vite forwards <CODE>/api</CODE> to the gateway on port 8080. These development servers do not reproduce the cloud Entra boundary, and a cloud toolbox cannot reach your workstation's <CODE>localhost</CODE>.</P> <H3 id="inspect-the-api-progressively">Inspect the API progressively</H3> <P>With the local gateway running, start with a health request in a separate PowerShell terminal:</P> <PRE><CODE>$base = "http://127.0.0.1:8080" Invoke-RestMethod "$base/api/health"</CODE></PRE> <P>Next, create a UUID conversation and submit one synthetic request:</P> <LI-CODE lang="">$session = [guid]::NewGuid().ToString() $body = @{ message = "Show me WO-007."; session_id = $session } | ConvertTo-Json -Compress $response = Invoke-WebRequest "$base/api/chat" -Method Post -ContentType "application/json" -Body $body $response.Headers["X-Session-Id"] $response.Content</LI-CODE> <P>This prints the completed SSE body rather than animating the stream. Reuse the same session for a follow-up by extracting a small helper:</P> <LI-CODE lang="">function Invoke-FibeyTurn { param([string] $Message, [string] $SessionId) $payload = @{ message = $Message; session_id = $SessionId } | ConvertTo-Json -Compress $result = Invoke-WebRequest "$base/api/chat" -Method Post ` -ContentType "application/json" -Body $payload return $result.Content } Invoke-FibeyTurn -Message "What parts does that work order need?" -SessionId $session</LI-CODE> <P>The helper uses <CODE>$base</CODE> and <CODE>$session</CODE> from the preceding examples. It makes continuity explicit without hiding the API contract. The browser remains the better place to watch incremental text and activity. See <A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/docs/local-development.md" target="_blank" rel="noopener">local development</A> for reset behavior and supporting-service details.</P> <H2 id="5-deploy-artifacts-and-infrastructure-together">5. Deploy artifacts and infrastructure together</H2> <P>Fibey's initial deployment is intentionally staged. A container image, its target port, its health probes, its registry association, and its runtime permissions must agree. Successfully building an image does not establish that agreement.</P> <P>The first supporting-infrastructure pass creates placeholder apps on port 80. Once all five real images have been published, a second pass applies the images with their application ports and probes. Plain <CODE>azd deploy</CODE> of a supporting service is not the initial port-switch mechanism for this sample.</P> <P>The <A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/docs/deployment_guide.md" target="_blank" rel="noopener">deployment guide</A> gives the complete sequence and prerequisites:</P> <OL> <LI>Select the intended environment and provision the Foundry layer.</LI> <LI>Configure project aliases, the Entra application, the allowed user, and separate API keys.</LI> <LI>Provision placeholder supporting apps and verify scoped access and registry identity associations.</LI> <LI>Publish all five supporting images and confirm every image setting is populated.</LI> <LI>Provision supporting infrastructure again to apply the matching images, ports, and probes.</LI> <LI>Run knowledge setup, then toolbox setup.</LI> <LI>Deploy <CODE>fibey-agent</CODE> and perform protected-path acceptance checks.</LI> </OL> <P>For example, this publication step comes after placeholders and access checks, not at the start of an unconfigured environment:</P> <LI-CODE lang="">azd publish status-dashboard azd publish inventory-mcp azd publish work-orders-api azd publish gateway azd publish ui</LI-CODE> <P>Only after all five <CODE>SERVICE_*_IMAGE_NAME</CODE> settings exist should the next <CODE>azd provision infra</CODE> apply them. Keep those settings: an empty value selects a placeholder again.</P> <P>This is where DevOps becomes tangible. Review source, Bicep, locks, schemas, skills, and configuration together; record accepted image references, model configuration, toolbox version, and hosted-agent version. GitOps adds controlled reconciliation of reviewed desired state. The repository supplies the ingredients, not an existing CI/CD pipeline or GitOps controller.</P> <P>Toolbox promotion deserves the same discipline. The unversioned consumer endpoint follows the published default version. A version-specific developer endpoint can test a candidate before promotion. Updating a shared connection or default can affect consumers without rebuilding their images, so Git history alone is not a rollback mechanism.</P> <H2 id="6-treat-governance-observability-and-scale-as-separate-concerns">6. Treat governance, observability, and scale as separate concerns</H2> <P>Role-based access control (RBAC) grants an identity permission at a resource scope. The control plane creates and configures Azure resources; the data plane performs application work such as invoking agents, querying Search, or reading blobs.</P> <P>The identities used across those operations are not interchangeable. In particular, a successful UI login is not automatic end-user identity passthrough to every tool, and resource provisioning permissions do not establish all runtime permissions.</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><thead><tr><th>Boundary</th><th>Identity or credential</th></tr></thead><tbody><tr><td>Browser to UI</td><td>Entra user, application registration, and user allowlist</td></tr><tr><td>Gateway to Foundry</td><td>Gateway managed identity with project-scoped invocation access</td></tr><tr><td>Hosted agent to model and toolbox</td><td>Foundry-provided runtime agent identity</td></tr><tr><td>Toolbox to inventory and work orders</td><td>Separate API keys stored in project connections</td></tr><tr><td>Toolbox to Search knowledge base</td><td>Foundry project managed identity</td></tr><tr><td>Search indexer to documents</td><td>Search managed identity with Blob reader access</td></tr></tbody><colgroup><col style="width: 50.00%" /><col style="width: 50.00%" /></colgroup></table></DIV> <P>Image delivery adds another boundary: each supporting app needs both <CODE>AcrPull</CODE> and a registry association selecting its identity. The Foundry project identity used for infrastructure operations is also distinct from the hosted agent's runtime identity.</P> <H3 id="approval-must-exist-outside-the-prompt">Approval must exist outside the prompt</H3> <P>Fibey's synthetic work-order writes run without an enforced human approval round trip. That is appropriate to understand in a disposable demo and inappropriate to conceal when discussing production.</P> <P>The <A href="https://learn.microsoft.com/azure/foundry/agents/how-to/tools/use-toolbox-hosted-agent" target="_blank" rel="noopener">hosted toolbox documentation</A> is explicit: approval metadata alone does not block <CODE>tools/call</CODE>. The runtime must pause, collect a decision, and resume or reject the exact proposed operation. A prompt saying "ask first" is not equivalent to that control.</P> <P>Real writes need server-side authorization, approval tied to the arguments, idempotency, and a durable audit record. If a write's response is uncertain, read its state before retrying. Treat tool results as untrusted data rather than instructions.</P> <H3 id="debug-the-boundary-that-failed">Debug the boundary that failed</H3> <P>The activity sidebar makes tool use visible, but it is not a durable audit log or access to the model's hidden reasoning. Combine it with timestamps, request/session identifiers, ACA logs, and configured hosted traces.</P> <P>Keep sensitive message tracing off unless a controlled investigation explicitly requires it. Verify that a synthetic trace reaches the intended sink; enabled instrumentation alone does not prove ingestion.</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><thead><tr><th>Symptom</th><th>First checks</th></tr></thead><tbody><tr><td>UI returns 502</td><td>Gateway revision, target port, fixed Nginx upstream, SNI, and certificate trust</td></tr><tr><td>Agent or tool returns 401/403</td><td>Identity, token audience, role scope, and downstream connection credential</td></tr><tr><td>Knowledge retrieval fails</td><td>Indexer completion, project Search role, API version, and advertised input schema</td></tr><tr><td>Briefing receives 429</td><td>Model quota, concurrency, retrieval budgets, and repeated tool calls</td></tr><tr><td>Stream ends early</td><td>Terminal response event, timeout, malformed SSE, and transport failure</td></tr></tbody><colgroup><col style="width: 50.00%" /><col style="width: 50.00%" /></colgroup></table></DIV> <P>The gateway must surface failed or truncated streams rather than treating partial text as a completed action. A final stream terminator after an error is not application success.</P> <H3 id="scale-only-after-identifying-state-and-capacity-limits">Scale only after identifying state and capacity limits</H3> <P>Foundry manages hosted runtime capabilities, but it does not externalize Fibey's gateway mappings or in-memory work orders. Adding replicas before redesigning that state would undermine continuity and consistent updates.</P> <P>Model throughput, hosted compute, downstream API capacity, Search, and ACA are separate constraints. Measure latency, errors, tokens, tool counts, and recovery under concurrent load. Registry storage/builds, model inference, compute, Search, Blob Storage, and telemetry all have costs; using a managed platform does not remove the need for budgets.</P> <H2 id="7-evaluate-the-result-before-adding-more-agents">7. Evaluate the result before adding more agents</H2> <P>The practical result is an inspectable workflow that combines heterogeneous systems into a grounded response. We can demonstrate inventory lookup, a synthetic work order, cited knowledge, a fixed status fetch, and a combined briefing through one agent-facing toolbox.</P> <P>That is functional evidence, not a production certification or benchmark. This post does not establish latency percentiles, cost per successful task, throughput, or availability under load. Those measurements should be acceptance criteria for an adaptation, not numbers inferred from a screenshot.</P> <P>Multi-agent coordination is a possible next design, not deployed Fibey behavior. A coordinator could delegate read-only inventory and procedure tasks while a restricted specialist handles approved writes. Each handoff would need typed inputs/results, correlation IDs, deadlines, cancellation, and budgets.</P> <P>Sharing a toolbox alone does not implement that coordination. Specialists also introduce additional failure paths, identity decisions, and state. Start with them only when task complexity, ownership, or isolation requirements justify the cost. The current five skills already provide modular instructions without creating five independently operated agents.</P> <H2 id="8-summary-reuse-the-engineering-boundaries">8. Summary: reuse the engineering boundaries</H2> <P>Fibey's reusable pattern is the separation of model reasoning, task instructions, tool contracts, hosted execution, and operational controls. MCP gives the agent a common tool interface; Foundry supplies managed hosting and integration capabilities. The application team remains responsible for the guarantees around its data and actions.</P> <P>Start with one workflow and verify each boundary. Then add durable state, per-user authorization, enforced approvals, secret rotation, appropriate networking, evaluation, and recovery before introducing real operational data or more autonomous behavior.</P> <P>For a practical starting point, use the <A href="https://github.com/leestott/fibey-toolbox-demo" target="_blank" rel="noopener">repository</A>, follow the <A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/docs/deployment_guide.md" target="_blank" rel="noopener">deployment guide</A>, and reproduce the <A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/docs/session-overview.md" target="_blank" rel="noopener">session walkthrough</A> with synthetic data. The <A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/slides/fibey-hosted-agents-mcp.pptx" target="_blank" rel="noopener">presentation deck</A> provides the same architecture and demo sequence for a team discussion.</P> <H2 id="references">References</H2> <P>The repository describes what this sample implements. Microsoft documentation describes the surrounding platform capabilities, responsibilities, and supported integration contracts.</P> <P>Read both before adapting the solution, especially where preview APIs, identity behavior, or approval enforcement affect your requirements.</P> <UL> <LI><A href="https://github.com/leestott/fibey-toolbox-demo" target="_blank" rel="noopener">Fibey Field Ops repository</A></LI> <LI><A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/docs/architecture.md" target="_blank" rel="noopener">Fibey engineering architecture</A></LI> <LI><A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/docs/deployment_guide.md" target="_blank" rel="noopener">Fibey deployment guide</A></LI> <LI><A class="lia-external-url" href="https://github.com/leestott/fibey-toolbox-demo/blob/main/docs/toolbox-integration.md" target="_blank" rel="noopener">Fibey toolbox integration</A></LI> <LI><A class="lia-external-url" href="https://learn.microsoft.com/azure/foundry/agents/concepts/hosted-agents" target="_blank" rel="noopener">Microsoft Foundry hosted agents</A></LI> <LI><A class="lia-external-url" href="https://learn.microsoft.com/azure/foundry/agents/how-to/tools/use-toolbox-hosted-agent" target="_blank" rel="noopener">Use a toolbox with a hosted agent</A></LI> <LI><A class="lia-external-url" href="https://github.com/microsoft-foundry/foundry-samples/tree/main/samples/python/hosted-agents/agent-framework/responses/04-foundry-toolbox" target="_blank" rel="noopener">Official Python hosted-agent toolbox sample</A></LI> </UL> Wed, 23 Sep 2026 07:00:00 GMT https://techcommunity.microsoft.com/t5/microsoft-developer-community/microsoft-foundry-hosted-agents-and-mcp-in-practice-building/ba-p/4557526 Lee_Stott 2026-09-23T07:00:00Z https://techcommunity.microsoft.com/t5/azure-events/azure-incident-retrospective-please-register-session-2-tracking/ec-p/4559133#M773 <H2>Join our upcoming live webcast for a transparent discussion about this recent Azure service incident led by our engineering teams.</H2> <P><SPAN data-olk-copy-source="MailCompose">Power issue in Southeast Asia</SPAN></P> <P>Tracking ID: SPCX-S1Z | Impacted: 25-26 August 2026</P> <P>Same content presented in both sessions: pick the one that works best for your timezone!</P> <H2><STRONG>What to expect</STRONG></H2> <P><STRONG>📚 Understand</STRONG></P> <P>What happened, how we responded, and what we learned</P> <P><STRONG>💬 Ask</STRONG></P> <P>Live Q&amp;A with our engineering experts throughout the session</P> <P><STRONG>🛠 Learn</STRONG></P> <P>The fixes we've put in place and guidance for workload resiliency</P> <H2><STRONG>Choose your session</STRONG></H2> <P>Same content presented at both times: pick the one that works best for your timezone:</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><tbody><tr><td> <P><STRONG data-olk-copy-source="MailCompose">Session 1</STRONG></P> <P><STRONG>15:30 UTC</STRONG></P> <P><STRONG>Thursday, 24 Sept 2026</STRONG></P> <P><STRONG><A href="https://aka.ms/air/SPCX-S1Z/1" target="_blank" rel="noopener">Register now →</A></STRONG></P> </td><td> <P><STRONG data-olk-copy-source="MailCompose">Session 2</STRONG></P> <P><STRONG>03:30 UTC</STRONG></P> <P><STRONG>Friday, 25 Sept 2026</STRONG></P> <P><STRONG><A href="https://aka.ms/air/SPCX-S1Z/2" target="_blank" rel="noopener">Register now →</A></STRONG></P> </td></tr><tr><td> <P>8:30 AM US Pacific (PDT)</P> <P>11:30 AM US Eastern (EDT)</P> <P>4:30 PM London (BST)</P> <P>11:30 PM Beijing (CST)</P> <P>1:30 AM +1 Sydney (AEDT)</P> <P>3:30 AM +1 Auckland (NZDT)</P> </td><td> <P>8:30 PM -1 US Pacific (PDT)</P> <P>11:30 PM -1 US Eastern (EDT)</P> <P>4:30 AM London (BST)</P> <P>11:30 AM Beijing (CST)</P> <P>1:30 PM Sydney (AEDT)</P> <P>3:30 PM Auckland (NZDT)</P> </td></tr></tbody><colgroup><col style="width: 50.00%" /><col style="width: 50.00%" /></colgroup></table></DIV> <H2><STRONG>Our engineering leaders</STRONG></H2> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><tbody><tr><td><table border="1" style="border-width: 1px;"><tbody><tr><td> <P>&nbsp;</P> <img /> <P class="lia-align-center"><STRONG>Terry Lo</STRONG></P> <P class="lia-align-center">Datacenter Operations Manager</P> <P class="lia-align-center">Southeast Asia</P> <P class="lia-align-center">Cloud+AI Engineering</P> <P class="lia-align-center"><STRONG><A href="https://www.linkedin.com/in/terry-lo-19b58322/" target="_blank" rel="noopener">LinkedIn </A><A href="https://www.linkedin.com/in/terry-lo-19b58322/" target="_blank" rel="noopener">↗</A></STRONG></P> </td></tr></tbody><colgroup><col style="width: 100.00%" /></colgroup></table></td></tr></tbody><colgroup><col style="width: 100.00%" /></colgroup></table></DIV> <P>⚠️ Prepare before the livestream</P> <P>Read the&nbsp;<A href="https://aka.ms/AzurePIRs" target="_blank" rel="noopener"><STRONG>Post Incident Review (PIR)</STRONG></A>&nbsp;ahead of time so you can ask any follow up questions during the live Q&amp;A</P> <H2><STRONG>Helpful resources</STRONG></H2> <P>🔔&nbsp;<A href="https://aka.ms/ash-alerts" target="_blank" rel="noopener" data-auth="NotApplicable">Azure Service Health Alerts</A></P> <P>Get alerts for relevant incidents by setting up notifications via email, SMS, or webhook</P> <P>🎥&nbsp;<A href="https://aka.ms/air/videos" target="_blank" rel="noopener" data-auth="NotApplicable">Past Retrospective Recordings</A></P> <P>Watch recordings of previous retrospective livestreams</P> <P>📄&nbsp;<A href="https://aka.ms/AzurePIRs" target="_blank" rel="noopener" data-auth="NotApplicable">Azure Post Incident Reviews</A></P> <P>Learn more about PIRs and the retrospective program</P> Wed, 23 Sep 2026 01:32:54 GMT https://techcommunity.microsoft.com/t5/azure-events/azure-incident-retrospective-please-register-session-2-tracking/ec-p/4559133#M773 SaiVai 2026-09-23T01:32:54Z https://techcommunity.microsoft.com/t5/azure-events/azure-incident-retrospective-please-register-session-1-tracking/ec-p/4559132#M772 <H2>Join our upcoming live webcast for a transparent discussion about this recent Azure service incident led by our engineering teams.</H2> <P><SPAN data-olk-copy-source="MailCompose">Power issue in Southeast Asia</SPAN></P> <P>Tracking ID: SPCX-S1Z | Impacted: 25-26 August 2026</P> <P>Same content presented in both sessions: pick the one that works best for your timezone!</P> <H2><STRONG>What to expect</STRONG></H2> <P><STRONG>📚 Understand</STRONG></P> <P>What happened, how we responded, and what we learned</P> <P><STRONG>💬 Ask</STRONG></P> <P>Live Q&amp;A with our engineering experts throughout the session</P> <P><STRONG>🛠 Learn</STRONG></P> <P>The fixes we've put in place and guidance for workload resiliency</P> <H2><STRONG>Choose your session</STRONG></H2> <P>Same content presented at both times: pick the one that works best for your timezone:</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><tbody><tr><td> <P><STRONG data-olk-copy-source="MailCompose">Session 1</STRONG></P> <P><STRONG>15:30 UTC</STRONG></P> <P><STRONG>Thursday, 24 Sept 2026</STRONG></P> <P><STRONG><A class="lia-external-url" href="https://aka.ms/air/SPCX-S1Z/1" target="_blank" rel="noopener">Register now →</A></STRONG></P> </td><td> <P><STRONG data-olk-copy-source="MailCompose">Session 2</STRONG></P> <P><STRONG>03:30 UTC</STRONG></P> <P><STRONG>Friday, 25 Sept 2026</STRONG></P> <P><STRONG><A class="lia-external-url" href="https://aka.ms/air/SPCX-S1Z/2" target="_blank" rel="noopener">Register now →</A></STRONG></P> </td></tr><tr><td> <P>8:30 AM US Pacific (PDT)</P> <P>11:30 AM US Eastern (EDT)</P> <P>4:30 PM London (BST)</P> <P>11:30 PM Beijing (CST)</P> <P>1:30 AM +1 Sydney (AEDT)</P> <P>3:30 AM +1 Auckland (NZDT)</P> </td><td> <P>8:30 PM -1 US Pacific (PDT)</P> <P>11:30 PM -1 US Eastern (EDT)</P> <P>4:30 AM London (BST)</P> <P>11:30 AM Beijing (CST)</P> <P>1:30 PM Sydney (AEDT)</P> <P>3:30 PM Auckland (NZDT)</P> </td></tr></tbody><colgroup><col style="width: 50.00%" /><col style="width: 50.00%" /></colgroup></table></DIV> <H2><STRONG>Our engineering leaders</STRONG></H2> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table border="1" style="border-width: 1px;"><tbody><tr><td><table border="1" style="border-width: 1px;"><tbody><tr><td> <P>&nbsp;</P> <img /> <P class="lia-align-center"><STRONG>Terry Lo</STRONG></P> <P class="lia-align-center">Datacenter Operations Manager</P> <P class="lia-align-center">Southeast Asia</P> <P class="lia-align-center">Cloud+AI Engineering</P> <P class="lia-align-center"><STRONG><A class="lia-external-url" href="https://www.linkedin.com/in/terry-lo-19b58322/" target="_blank" rel="noopener">LinkedIn </A><A href="https://www.linkedin.com/in/terry-lo-19b58322/" target="_blank" rel="noopener">↗</A></STRONG></P> </td></tr></tbody><colgroup><col style="width: 100.00%" /></colgroup></table></td></tr></tbody><colgroup><col style="width: 100.00%" /></colgroup></table></DIV> <P>⚠️ Prepare before the livestream</P> <P>Read the&nbsp;<A href="https://aka.ms/AzurePIRs" target="_blank" rel="noopener"><STRONG>Post Incident Review (PIR)</STRONG></A>&nbsp;ahead of time so you can ask any follow up questions during the live Q&amp;A</P> <H2><STRONG>Helpful resources</STRONG></H2> <P>🔔&nbsp;<A href="https://aka.ms/ash-alerts" target="_blank" rel="noopener" data-auth="NotApplicable">Azure Service Health Alerts</A></P> <P>Get alerts for relevant incidents by setting up notifications via email, SMS, or webhook</P> <P>🎥&nbsp;<A href="https://aka.ms/air/videos" target="_blank" rel="noopener" data-auth="NotApplicable">Past Retrospective Recordings</A></P> <P>Watch recordings of previous retrospective livestreams</P> <P>📄&nbsp;<A href="https://aka.ms/AzurePIRs" target="_blank" rel="noopener" data-auth="NotApplicable">Azure Post Incident Reviews</A></P> <P>Learn more about PIRs and the retrospective program</P> Wed, 23 Sep 2026 01:32:04 GMT https://techcommunity.microsoft.com/t5/azure-events/azure-incident-retrospective-please-register-session-1-tracking/ec-p/4559132#M772 SaiVai 2026-09-23T01:32:04Z https://techcommunity.microsoft.com/t5/azure-events/azure-retirements-livestream-please-register-session-2-tracking/ec-p/4559131#M771 <H2>Join our upcoming live webcast for a transparent discussion about this upcoming Azure retirement — led by our engineering teams.</H2> <P><SPAN data-olk-copy-source="MailCompose">Network Security Group (NSG) flow logs in Azure Network Watcher</SPAN></P> <P>Tracking ID: 0P59-60Z | Retirement Date: 30 September 2027</P> <P>Same content presented in both sessions — pick the one that works best for your timezone!</P> <H2><STRONG>What to expect</STRONG></H2> <P><STRONG>📚 Understand</STRONG></P> <P>What will happen, the timelines for the change, and how you can manage it</P> <P><STRONG>💬 Ask</STRONG></P> <P>Live Q&amp;A with our engineering experts throughout the session</P> <P><STRONG>🛠 Learn</STRONG></P> <P>How to manage the change smoothly</P> <H2><STRONG>Choose your session</STRONG></H2> <P>Same content presented at both times — pick the one that works best for your timezone:</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table><tbody><tr><td> <P><STRONG data-olk-copy-source="MailCompose">Session 1</STRONG></P> <P><STRONG>16:30 UTC</STRONG></P> <P><STRONG>Thursday, 24 Sept 2026</STRONG></P> <P><STRONG><A class="lia-external-url" href="https://aka.ms/air/0P59-60Z/1" target="_blank">Register now →</A></STRONG></P> </td><td> <P><STRONG data-olk-copy-source="MailCompose">Session 2</STRONG></P> <P><STRONG>04:30 UTC</STRONG></P> <P><STRONG>Friday, 25 Sept 2026</STRONG></P> <P><STRONG><A class="lia-external-url" href="https://aka.ms/air/0P59-60Z/2" target="_blank">Register now →</A></STRONG></P> </td></tr><tr><td> <P>9:30 AM US Pacific (PDT)</P> <P>12:30 PM US Eastern (EDT)</P> <P>5:30 PM London (BST)</P> <P>12:30 AM +1 Beijing (CST)</P> <P>2:30 AM +1 Sydney (AEDT)</P> <P>4:30 AM +1 Auckland (NZDT)</P> </td><td> <P>9:30 PM -1 US Pacific (PDT)</P> <P>12:30 AM US Eastern (EDT)</P> <P>5:30 AM London (BST)</P> <P>12:30 PM Beijing (CST)</P> <P>2:30 PM Sydney (AEDT)</P> <P>4:30 PM Auckland (NZDT)</P> </td></tr></tbody></table></DIV> <H2><STRONG>Our engineering leaders</STRONG></H2> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table style="width: 46.3636%;"><tbody><tr><td> <P>&nbsp;</P> <img /> <P class="lia-align-center"><STRONG>Chaithanya Rai</STRONG></P> <P class="lia-align-center">Senior Product Manager</P> <P class="lia-align-center">Azure Network Security &amp; Observability</P> <P class="lia-align-center"><A href="https://www.linkedin.com/in/chaithanya-rai-21853a62/" target="_blank"><STRONG>LinkedIn </STRONG></A><A href="https://www.linkedin.com/in/chaithanya-rai-21853a62/" target="_blank"><STRONG>↗</STRONG></A></P> </td></tr></tbody></table></DIV> <H2><STRONG>Helpful resources</STRONG></H2> <P>🔔&nbsp;<A href="https://aka.ms/ash-alerts" data-auth="NotApplicable" target="_blank">Azure Service Health Alerts</A></P> <P>Get alerts for relevant incidents by setting up notifications via email, SMS, or webhook</P> <P>🎥&nbsp;<A href="https://aka.ms/air/videos" data-auth="NotApplicable" target="_blank">Past Retrospective Recordings</A></P> <P>Watch recordings of previous retrospective livestreams</P> <P>📄&nbsp;<A href="https://aka.ms/AzurePIRs" data-auth="NotApplicable" target="_blank">Azure Post Incident Reviews</A></P> <P>Learn more about PIRs and the retrospective program</P> Wed, 23 Sep 2026 01:14:02 GMT https://techcommunity.microsoft.com/t5/azure-events/azure-retirements-livestream-please-register-session-2-tracking/ec-p/4559131#M771 SaiVai 2026-09-23T01:14:02Z https://techcommunity.microsoft.com/t5/azure-events/azure-retirements-livestream-please-register-session-1-tracking/ec-p/4559130#M770 <H2>Join our upcoming live webcast for a transparent discussion about this upcoming Azure retirement — led by our engineering teams.</H2> <P><SPAN data-olk-copy-source="MailCompose">Network Security Group (NSG) flow logs in Azure Network Watcher</SPAN></P> <P>Tracking ID: 0P59-60Z | Retirement Date: 30 September 2027</P> <P>Same content presented in both sessions — pick the one that works best for your timezone!</P> <H2><STRONG>What to expect</STRONG></H2> <P><STRONG>📚 Understand</STRONG></P> <P>What will happen, the timelines for the change, and how you can manage it</P> <P><STRONG>💬 Ask</STRONG></P> <P>Live Q&amp;A with our engineering experts throughout the session</P> <P><STRONG>🛠 Learn</STRONG></P> <P>How to manage the change smoothly</P> <H2><STRONG>Choose your session</STRONG></H2> <P>Same content presented at both times — pick the one that works best for your timezone:</P> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table><tbody><tr><td> <P><STRONG data-olk-copy-source="MailCompose">Session 1</STRONG></P> <P><STRONG>16:30 UTC</STRONG></P> <P><STRONG>Thursday, 24 Sept 2026</STRONG></P> <P><STRONG><A class="lia-external-url" href="https://aka.ms/air/0P59-60Z/1" target="_blank">Register now →</A></STRONG></P> </td><td> <P><STRONG data-olk-copy-source="MailCompose">Session 2</STRONG></P> <P><STRONG>04:30 UTC</STRONG></P> <P><STRONG>Friday, 25 Sept 2026</STRONG></P> <P><STRONG><A class="lia-external-url" href="https://aka.ms/air/0P59-60Z/2" target="_blank">Register now →</A></STRONG></P> </td></tr><tr><td> <P>9:30 AM US Pacific (PDT)</P> <P>12:30 PM US Eastern (EDT)</P> <P>5:30 PM London (BST)</P> <P>12:30 AM +1 Beijing (CST)</P> <P>2:30 AM +1 Sydney (AEDT)</P> <P>4:30 AM +1 Auckland (NZDT)</P> </td><td> <P>9:30 PM -1 US Pacific (PDT)</P> <P>12:30 AM US Eastern (EDT)</P> <P>5:30 AM London (BST)</P> <P>12:30 PM Beijing (CST)</P> <P>2:30 PM Sydney (AEDT)</P> <P>4:30 PM Auckland (NZDT)</P> </td></tr></tbody></table></DIV> <H2><STRONG>Our engineering leaders</STRONG></H2> <DIV class="styles_lia-table-wrapper__h6Xo9 styles_table-responsive__MW0lN"><table><tbody><tr><td> <P>&nbsp;</P> <img /> <P>&nbsp;</P> <P><STRONG>Chaithanya Rai</STRONG></P> <P>Senior Product Manager</P> <P>Azure Network Security &amp; Observability</P> <P><A href="https://www.linkedin.com/in/chaithanya-rai-21853a62/" target="_blank"><STRONG>LinkedIn </STRONG></A><A href="https://www.linkedin.com/in/chaithanya-rai-21853a62/" target="_blank"><STRONG>↗</STRONG></A></P> <P>&nbsp;</P> </td></tr></tbody></table></DIV> <H2><STRONG>Helpful resources</STRONG></H2> <P>🔔&nbsp;<A href="https://aka.ms/ash-alerts" data-auth="NotApplicable" target="_blank">Azure Service Health Alerts</A></P> <P>Get alerts for relevant incidents by setting up notifications via email, SMS, or webhook</P> <P>🎥&nbsp;<A href="https://aka.ms/air/videos" data-auth="NotApplicable" target="_blank">Past Retrospective Recordings</A></P> <P>Watch recordings of previous retrospective livestreams</P> <P>📄&nbsp;<A href="https://aka.ms/AzurePIRs" data-auth="NotApplicable" target="_blank">Azure Post Incident Reviews</A></P> <P>Learn more about PIRs and the retrospective program</P> Wed, 23 Sep 2026 01:10:03 GMT https://techcommunity.microsoft.com/t5/azure-events/azure-retirements-livestream-please-register-session-1-tracking/ec-p/4559130#M770 SaiVai 2026-09-23T01:10:03Z